19940092d20b10a414c5fa9f0d8c8da8c70b68f7b0f49945324c030e51a5af19

Analysis

max time kernel
59s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
Size 288KB
Sample261006-sdq2ba1vat
SHA256 19940092d20b10a414c5fa9f0d8c8da8c70b68f7b0f49945324c030e51a5af19
MD5 6a063289be7c4a922dc0adf3c3b08db1
SHA1 b733103d16494b0cf39be81fc8f2f6a84dab9807
SHA512 f38f3f9cb3ab54012d550fe0d92035aa8a895b44c9c0ba00432e4abb2aef11b763a331824bc47a5c5b1fcf79a06088d71d7ae6790fbc4d37db11380838c5497b
SSDEEP 6144:4PWALdrob64mNl/KhLtLk+mCj/QAkJXUBr/:4RZT/+h5mWILJXcr/
TLSH
T1F354120233D1D6A5D76D8A3258F7A38E7BF51A0B9816D2DA7C8C90761FF2BC005526A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 2392	3448	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	90
PID 2392 wrote to memory of 5340	2392	vbc.exe	92
PID 3448 wrote to memory of 3196	3448	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	93
PID 3196 wrote to memory of 4868	3196	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	94
PID 4868 wrote to memory of 4520	4868	vbc.exe	96
PID 3196 wrote to memory of 5712	3196	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	97
PID 5712 wrote to memory of 5292	5712	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	98
PID 5292 wrote to memory of 1768	5292	vbc.exe	100
PID 5712 wrote to memory of 1552	5712	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	101
PID 1552 wrote to memory of 2612	1552	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	102
PID 2612 wrote to memory of 4592	2612	vbc.exe	104
PID 1552 wrote to memory of 2680	1552	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	105
PID 2680 wrote to memory of 4800	2680	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	106
PID 4800 wrote to memory of 6068	4800	vbc.exe	108
PID 2680 wrote to memory of 3264	2680	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	109
PID 3264 wrote to memory of 5648	3264	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	110
PID 5648 wrote to memory of 2708	5648	vbc.exe	112
PID 3264 wrote to memory of 2088	3264	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	113
PID 2088 wrote to memory of 4960	2088	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	114
PID 4960 wrote to memory of 2516	4960	vbc.exe	116
PID 2088 wrote to memory of 1832	2088	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	117
PID 1832 wrote to memory of 5876	1832	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	118
PID 5876 wrote to memory of 2324	5876	vbc.exe	120
PID 1832 wrote to memory of 4900	1832	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	121
PID 4900 wrote to memory of 5504	4900	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	122
PID 5504 wrote to memory of 3044	5504	vbc.exe	124
PID 4900 wrote to memory of 484	4900	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	125
PID 484 wrote to memory of 1236	484	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	126
PID 1236 wrote to memory of 6044	1236	vbc.exe	128
PID 484 wrote to memory of 1232	484	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	129
PID 1232 wrote to memory of 1288	1232	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	130
PID 1288 wrote to memory of 5960	1288	vbc.exe	132
PID 1232 wrote to memory of 5516	1232	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	133
PID 5516 wrote to memory of 2572	5516	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	134
PID 2572 wrote to memory of 4772	2572	vbc.exe	136
PID 5516 wrote to memory of 4936	5516	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	137
PID 4936 wrote to memory of 5108	4936	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	138
PID 5108 wrote to memory of 3768	5108	vbc.exe	140
PID 4936 wrote to memory of 868	4936	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	141
PID 868 wrote to memory of 2896	868	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	142
PID 2896 wrote to memory of 5524	2896	vbc.exe	144
PID 868 wrote to memory of 5004	868	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	145
PID 5004 wrote to memory of 728	5004	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	146
PID 728 wrote to memory of 3416	728	vbc.exe	148
PID 5004 wrote to memory of 5468	5004	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	149
PID 5468 wrote to memory of 468	5468	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	150
PID 468 wrote to memory of 2620	468	vbc.exe	152
PID 5468 wrote to memory of 2884	5468	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	153
PID 2884 wrote to memory of 4320	2884	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	154
PID 4320 wrote to memory of 5948	4320	vbc.exe	215
PID 2884 wrote to memory of 2752	2884	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	157
PID 2752 wrote to memory of 1260	2752	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	158
PID 1260 wrote to memory of 124	1260	vbc.exe	160
PID 2752 wrote to memory of 3832	2752	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	161
PID 3832 wrote to memory of 5892	3832	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	162
PID 5892 wrote to memory of 3680	5892	vbc.exe	222
PID 3832 wrote to memory of 5076	3832	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	165
PID 5076 wrote to memory of 4508	5076	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	166
PID 4508 wrote to memory of 3088	4508	vbc.exe	168
PID 5076 wrote to memory of 2828	5076	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	169
PID 2828 wrote to memory of 5800	2828	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	170
PID 5800 wrote to memory of 2872	5800	vbc.exe	172
PID 2828 wrote to memory of 3492	2828	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	173
PID 3492 wrote to memory of 2664	3492	jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe	174

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mj874q86.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF855.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA6ACB81E664B4ECB9E511C67C31CAFEE.TMP"
    3⤵
    PID:5340
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\29cypqhr.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE12.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc627A5A99B24D433D8AB8BBC454287252.TMP"
      4⤵
      PID:4520
- - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
    C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5712
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6urjpb6-.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5292
    - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES323.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB3EFF98DE5244E909A146FD5BE1E56C6.TMP"
        5⤵
        
        PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
      C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1552
    - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fblo45p2.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2612
      - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBDD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF47057566B4841FEB2BA0595FEEB6A6.TMP"
        6⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2680
      - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ixxvdsrk.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD64.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5809B29383004900829C7BF9408787E.TMP"
        7⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3ymqmkjs.cmdline"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5648
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEDB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc57698ADCBB0740889C5E89D0991FEEB0.TMP"
        8⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jy1xjq0_.cmdline"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1004.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc806FA589BF4349E585A73E90A2F8558F.TMP"
        9⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q5dk4wye.cmdline"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5876
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES117B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB7CE5DEE49024933A6A8C24DB9E0676C.TMP"
        10⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dmyxcnix.cmdline"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5504
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES12E2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6171CF2294D2478683B2E6D615E998C.TMP"
        11⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:484
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\d55njt95.cmdline"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1449.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4B0D82EF82248CDB14AB1A897633E45.TMP"
        12⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\17ndn4ix.cmdline"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1582.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8E83A2667651475C867D1FFBB450811D.TMP"
        13⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5516
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zxjfuhtj.cmdline"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES16AB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc92109D14680F48849558292A244A579F.TMP"
        14⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bkp5lw2p.cmdline"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES17D4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB174EA8A88794E95833F1848953FE7C.TMP"
        15⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qwntacv5.cmdline"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES194B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6D5E123839C547F8B3E5B4EAA671877.TMP"
        16⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ff5rqbpf.cmdline"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:728
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1A74.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA44153576ACD42929E1D6ECB90139BE3.TMP"
        17⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:5468
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nhjczucv.cmdline"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:468
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1BAC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1DEDB9BF78C46B1926B66D34BE139D.TMP"
        18⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0mufvadc.cmdline"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1CC5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc119ABBDACF164906BD53B3BEEE458A84.TMP"
        19⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9a0hif9h.cmdline"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:1260
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E1D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc400E4AADAD3A4EAB957DC7A2DC7688B1.TMP"
        20⤵
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\b1fp5hjz.cmdline"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:5892
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1F36.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA2CB3F9A84E45B5BD8EDF760B3C955.TMP"
        21⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cvtwnnly.cmdline"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES207E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC38E74DE20334C998C5A68EBB4925286.TMP"
        22⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rowrewiv.cmdline"
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:5800
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES21E6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc686086DD35DA402E82DB4EACB48157C3.TMP"
        23⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\t3k76p5m.cmdline"
        23⤵
        
        PID:2664
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES22D0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc746C0C30E0DD428982AF19C6B93EE3E.TMP"
        24⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        23⤵
        
        PID:4352
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2sngd1ye.cmdline"
        24⤵
        
        PID:3316
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2447.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc502C24B5750B4705AD7ADF7DD961545.TMP"
        25⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        24⤵
        
        PID:2724
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f8ap5ftm.cmdline"
        25⤵
        
        PID:5576
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES259F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE398DF6F5F4B467F85AFCFAB9195D64F.TMP"
        26⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        25⤵
        
        PID:1096
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wj41qmuc.cmdline"
        26⤵
        
        PID:4864
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2716.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7CAF3D21E9FF4FD8AFEAAB8AFD11B516.TMP"
        27⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        26⤵
        
        PID:2328
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\udwdfhh-.cmdline"
        27⤵
        
        PID:4196
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES285E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA289B3181E645E88DD1CEB0D4709A.TMP"
        28⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        27⤵
        
        PID:1180
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\w91as3sa.cmdline"
        28⤵
        
        PID:5856
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES29B6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDF3FDEEFAFCF40269EE4CEFD9EF94131.TMP"
        29⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        28⤵
        
        PID:1892
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\koj8tqbm.cmdline"
        29⤵
        
        PID:1120
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2ADF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc70031EFAB15345459563927251E451CD.TMP"
        30⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        29⤵
        
        PID:4392
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ttxqd2ao.cmdline"
        30⤵
        
        PID:3476
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2BC9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc69EB6D38213D4DAA99CF18FF709478CA.TMP"
        31⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        30⤵
        
        PID:1904
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ynru-tty.cmdline"
        31⤵
        
        PID:6132
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2CE2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc83ED9CEEBCAD488A83A877886D45E380.TMP"
        32⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        31⤵
        
        PID:1336
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rpx3mle6.cmdline"
        32⤵
        
        PID:4684
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E0B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE8BC67B0E4CD44AEAC4468AD8DE06FE4.TMP"
        33⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        32⤵
        
        PID:2916
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\abrpbd1y.cmdline"
        33⤵
        
        PID:1416
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        34⤵
        
        PID:5948
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2F63.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6E2BE4F31F2421180C950765FEC6E72.TMP"
        34⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        33⤵
        
        PID:2932
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1swvonhm.cmdline"
        34⤵
        
        PID:1592
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES30CA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5D11D3F1766846788F529BE0168C5E8B.TMP"
        35⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        34⤵
        
        PID:5088
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tydrdxo8.cmdline"
        35⤵
        
        PID:3680
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3203.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCCC249BD61E44A52BD6959FC23C47FC1.TMP"
        36⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        35⤵
        
        PID:4228
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rpzrfkco.cmdline"
        36⤵
        
        PID:912
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES330C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB0CBC376A6CA41C5B994E5DF616F9A.TMP"
        37⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        36⤵
        
        PID:4368
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\axp2yqs6.cmdline"
        37⤵
        
        PID:3432
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3455.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7D97CA7A8DE94C6CA1A7E3C5671F6FAB.TMP"
        38⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        37⤵
        
        PID:6092
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\n8kxr-db.cmdline"
        38⤵
        
        PID:4884
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES355E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF9BA56DDFBAD4DD5A6A5D72F469BC534.TMP"
        39⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        38⤵
        
        PID:4748
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sbd1mzs2.cmdline"
        39⤵
        
        PID:6088
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3668.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE0FB511A5A8147EDBE57BE54B2C1A4.TMP"
        40⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        39⤵
        
        PID:5040
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kdhwjvyr.cmdline"
        40⤵
        
        PID:6124
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES37C0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF64CA116AD3C4B089812EBAB326FC18.TMP"
        41⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        40⤵
        
        PID:5368
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xwf0s1mp.cmdline"
        41⤵
        
        PID:5720
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES38F8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc437977944D1C4E0E827E19ABC22C10C1.TMP"
        42⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        41⤵
        
        PID:3860
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zzbtegld.cmdline"
        42⤵
        
        PID:4604
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A21.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc84E8329CC56A40ADBB21A91C68979F1.TMP"
        43⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        42⤵
        
        PID:4888
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f5fsqo9u.cmdline"
        43⤵
        
        PID:5584
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B79.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA71536651B72499B8DCDFA82F899C758.TMP"
        44⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        43⤵
        
        PID:2232
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zxuyptzd.cmdline"
        44⤵
        
        PID:2540
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3CB1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA9B2C5CAB272471B8375F0C52C391ABC.TMP"
        45⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        44⤵
        
        PID:1412
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qpaqze00.cmdline"
        45⤵
        
        PID:3288
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3DCA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc67A91C66241049639D4414D96C679764.TMP"
        46⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        45⤵
        
        PID:1756
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k8uujrno.cmdline"
        46⤵
        
        PID:4400
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3EE4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE1C1B49FE0EF40AF9C17B9F2B24AA79.TMP"
        47⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        46⤵
        
        PID:4388
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rb8ejxm7.cmdline"
        47⤵
        
        PID:3964
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES400D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC2908A7C60BF4F6ABE56B3BD951E95.TMP"
        48⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        47⤵
        
        PID:5332
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l8v9lt2l.cmdline"
        48⤵
        
        PID:6084
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4145.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc986477BE32C54ED091A5749E4B554EF.TMP"
        49⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        48⤵
        
        PID:4592
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tstjv_9-.cmdline"
        49⤵
        
        PID:2836
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES428D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC1190353C79411F959243D34F56D974.TMP"
        50⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        49⤵
        
        PID:3088
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\h69lymu0.cmdline"
        50⤵
        
        PID:5756
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES43A6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE1701E997C48444F84C0FD5D85BF051.TMP"
        51⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        50⤵
        
        PID:4512
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cyzzc8jg.cmdline"
        51⤵
        
        PID:5532
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44EF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc35D4A97D19E844368EDE664A2ADCD37B.TMP"
        52⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        51⤵
        
        PID:4180
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tl4zgxf2.cmdline"
        52⤵
        
        PID:1728
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4617.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc10BA52ACAAF24581B91760BE7E608E45.TMP"
        53⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        52⤵
        
        PID:2080
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qrhaetpp.cmdline"
        53⤵
        
        PID:3044
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES479E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB8A1568A50D34BDEA374936DC7886.TMP"
        54⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        53⤵
        
        PID:6120
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bvolszgk.cmdline"
        54⤵
        
        PID:6044
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES48B7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc753BA259DD5B4673B781F43AF0287B61.TMP"
        55⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        54⤵
        
        PID:1148
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r9env1_c.cmdline"
        55⤵
        
        PID:1532
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A0F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA59101953D9744FF8CD9BF8D58F4B3B7.TMP"
        56⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        55⤵
        
        PID:5436
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ljnlglki.cmdline"
        56⤵
        
        PID:5960
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B48.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF27A745B46C04CDAA3C06289A2897F9.TMP"
        57⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        56⤵
        
        PID:1712
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qkakhakx.cmdline"
        57⤵
        
        PID:2072
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4CBF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEA6E3624141643F8B2A0AE41FF56EB37.TMP"
        58⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        57⤵
        
        PID:3216
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ziazkbd1.cmdline"
        58⤵
        
        PID:2208
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E16.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc298800CBD73F4F7F9C49DDF5324CA221.TMP"
        59⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        58⤵
        
        PID:5816
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\a4krkq1j.cmdline"
        59⤵
        
        PID:964
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4F3F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc55D5307A581645978620A18A4187E1.TMP"
        60⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        59⤵
        
        PID:2544
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ylgr1xuo.cmdline"
        60⤵
        
        PID:2312
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES50A7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc790C0BE5C14846C8B583A44D49BCF8C.TMP"
        61⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        60⤵
        
        PID:248
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v_ng7mcp.cmdline"
        61⤵
        
        PID:5624
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES51DF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5E3275BDF5C849B8891D8BE97C74F7A8.TMP"
        62⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        61⤵
        
        PID:264
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8cwkh9m7.cmdline"
        62⤵
        
        PID:2728
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5327.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDE9D8B046C184097A86C8C206CEAF2D8.TMP"
        63⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        62⤵
        
        PID:5344
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mq4fo3zh.cmdline"
        63⤵
        
        PID:2052
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES547F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCD557A01634F4ACD91913F717CBD37.TMP"
        64⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        63⤵
        
        PID:2516
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zxagodxl.cmdline"
        64⤵
        
        PID:5776
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES55C7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2AE0CAA927C04932BDD3E67C28788C2.TMP"
        65⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        64⤵
        
        PID:3408
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f8fgabkt.cmdline"
        65⤵
        
        PID:4996
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES56B1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9A693D61A4624F069A7DB29711A27FC3.TMP"
        66⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        65⤵
        
        PID:2324
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\09n41v_y.cmdline"
        66⤵
        
        PID:4548
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES578C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc976ADE89EF94F0BB219A513EAB4965F.TMP"
        67⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        66⤵
        
        PID:2380
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q6dm4jvs.cmdline"
        67⤵
        
        PID:3892
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5877.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA53A8AB115ED40BCA0EFC0C2E2FDAB2D.TMP"
        68⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        67⤵
        
        PID:3352
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\j15gitml.cmdline"
        68⤵
        
        PID:4772
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5942.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4F2F5F19BB724CB7A11C834A4FD5D496.TMP"
        69⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        68⤵
        
        PID:4792
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7sjgrrtn.cmdline"
        69⤵
        
        PID:716
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A3C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE40E7E8441E54E8881D87AA321E089F0.TMP"
        70⤵
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        69⤵
        
        PID:5260
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5cvydy5n.cmdline"
        70⤵
        
        PID:5268
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B26.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7263EAD0C8E045B0AF97574F72F4AC45.TMP"
        71⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        70⤵
        
        PID:3452
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\inqx0pwd.cmdline"
        71⤵
        
        PID:5324
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C01.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5DF3345DC9824819B2C75831781DF180.TMP"
        72⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        71⤵
        
        PID:4848
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\997rqfeq.cmdline"
        72⤵
        
        PID:1816
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5CEB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2FB18173B1A54B249F2B81B5627335.TMP"
        73⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        72⤵
        
        PID:4816
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\beictitg.cmdline"
        73⤵
        
        PID:556
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5DD6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc68FA1F8ACC374187A10959DB4F16C1.TMP"
        74⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        73⤵
        
        PID:3564
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u-y8ar7z.cmdline"
        74⤵
        
        PID:5780
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5EC0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE2BC2DFC824044B09A899FCC56794F3.TMP"
        75⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        74⤵
        
        PID:2436
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\n0tdf_js.cmdline"
        75⤵
        
        PID:4484
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5FAA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7B032A92D09740D98BFF332337F2872.TMP"
        76⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        75⤵
        
        PID:5164
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\c_0jhsoz.cmdline"
        76⤵
        
        PID:2972
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6085.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7B747627D8144561BAAF2FA278E3E3C3.TMP"
        77⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        76⤵
        
        PID:5192
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\frbcdal5.cmdline"
        77⤵
        
        PID:3520
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES618F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4473B5ACBD2A4E4792A74ED9DF4F725.TMP"
        78⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        77⤵
        
        PID:4804
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jgt70rup.cmdline"
        78⤵
        
        PID:5080
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6279.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD463F0CF6A4D0BA2746270EC4F5AA8.TMP"
        79⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        78⤵
        
        PID:5968
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rmmcosqk.cmdline"
        79⤵
        
        PID:5788
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6354.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc72499D53F88F40159DD33E3BED8D9228.TMP"
        80⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        79⤵
        
        PID:1520
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mw-rsb8z.cmdline"
        80⤵
        
        PID:5820
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES645D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc38670D59D9454DFABE1E5A49940C41A.TMP"
        81⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        80⤵
        
        PID:5488
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1abfnqa9.cmdline"
        81⤵
        
        PID:4280
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6567.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7C821A465C5944D68A44DD472CFF1BBB.TMP"
        82⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        81⤵
        
        PID:5536
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4jce6lwt.cmdline"
        82⤵
        
        PID:2764
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6680.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc570563A932C24FBAAD94782390EBCD8E.TMP"
        83⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        82⤵
        
        PID:4124
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\x-xuxwx8.cmdline"
        83⤵
        
        PID:4928
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES679A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAB533FE394314D9B8F6626195216294.TMP"
        84⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        83⤵
        
        PID:4840
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9lu9dirr.cmdline"
        84⤵
        
        PID:3780
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES68A3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9AA98DAE38B94632A426E55E6B2FD8B8.TMP"
        85⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        84⤵
        
        PID:4152
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\el5pchhd.cmdline"
        85⤵
        
        PID:1944
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES69AD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4123A6B35E1F48A9829AD845A9CA4D6.TMP"
        86⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        85⤵
        
        PID:2040
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-90umg-t.cmdline"
        86⤵
        
        PID:3176
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6AB6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC0D497DCF12240E892BC86F56E1467.TMP"
        87⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        86⤵
        
        PID:2784
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vmct52hz.cmdline"
        87⤵
        
        PID:5832
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6BC0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE0FBDA59596F4E74BAC0E6BCD3DA4BC7.TMP"
        88⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        87⤵
        
        PID:2168
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jdfrcld4.cmdline"
        88⤵
        
        PID:1760
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6CCA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc84EC7E611F749D58CBB94ADBE7E262A.TMP"
        89⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        88⤵
        
        PID:3236
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tvnkx7kr.cmdline"
        89⤵
        
        PID:5028
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6DE3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA1A8F21988FB423989DAB4E97898595.TMP"
        90⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        89⤵
        
        PID:5708
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\o3kpr6wj.cmdline"
        90⤵
        
        PID:5908
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6EFC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD3788B3D631C4C25A8DFE91358151086.TMP"
        91⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        90⤵
        
        PID:2024
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_cnshehi.cmdline"
        91⤵
        
        PID:2364
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6FE7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD31D105213864B48806BFF3CF064DE6A.TMP"
        92⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        91⤵
        
        PID:5524
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\g7zlxoe-.cmdline"
        92⤵
        
        PID:4340
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES70C1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8CCCF6CA71544E8FA5A8602F98359EB7.TMP"
        93⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        92⤵
        
        PID:4948
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nnxwrdwy.cmdline"
        93⤵
        
        PID:2012
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES71BB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc26F7258B43CC4FA8909A85CE89EE83A7.TMP"
        94⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        93⤵
        
        PID:5012
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yuyx4q7b.cmdline"
        94⤵
        
        PID:3968
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES72A6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc69F818108B7B4C6AB348455385FB21B4.TMP"
        95⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        94⤵
        
        PID:5688
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wldinqgf.cmdline"
        95⤵
        
        PID:5944
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES73DE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9D50E53D95DD49F9B51FD379645FCE.TMP"
        96⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        95⤵
        
        PID:3380
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\33mpb6cd.cmdline"
        96⤵
        
        PID:360
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7546.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7DB84290EFEA4AA398507DC6BA887EA3.TMP"
        97⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        96⤵
        
        PID:2016
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\guokmjrz.cmdline"
        97⤵
        
        PID:3140
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES765F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE081337EB05844C5B065B71D5F1415F.TMP"
        98⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        97⤵
        
        PID:4284
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dvfc5c_l.cmdline"
        98⤵
        
        PID:2580
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7788.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc95388A6BA3E94835B457C9B935BC1F53.TMP"
        99⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        98⤵
        
        PID:5572
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jembzlqx.cmdline"
        99⤵
        
        PID:4456
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7872.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc524D75874E2A4BFCAC73C3A67EF8916.TMP"
        100⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        99⤵
        
        PID:4532
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pufyda8_.cmdline"
        100⤵
        
        PID:3412
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES79D9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEABD550F5C554563B56191145632473B.TMP"
        101⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        100⤵
        
        PID:4372
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z0kzjj9d.cmdline"
        101⤵
        
        PID:5060
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7B22.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4A0451181F224D72A4A9205AAED99217.TMP"
        102⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        101⤵
        
        PID:2288
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\esfveyu2.cmdline"
        102⤵
        
        PID:4932
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7C2B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC7298CB98AB44FE1A63381B9B281DFA6.TMP"
        103⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        102⤵
        
        PID:6136
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\08iml_sh.cmdline"
        103⤵
        
        PID:1124
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7D64.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBFB58CAB6AD843D2942FD6C5254F8862.TMP"
        104⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        103⤵
        
        PID:4408
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\is_7wyz0.cmdline"
        104⤵
        
        PID:4904
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7E7D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAD97928019C54932BA58C5D276AC3E6D.TMP"
        105⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        104⤵
        
        PID:3420
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\y2vkzcfy.cmdline"
        105⤵
        
        PID:6064
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F87.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF977109DCD624209A714A25D8E8CF178.TMP"
        106⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        105⤵
        
        PID:4300
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lznm8kzr.cmdline"
        106⤵
        
        PID:4992
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES80EE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFDABF44A16C8474AB0D3B4B2BA2E25AA.TMP"
        107⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        106⤵
        
        PID:2620
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z_6v8haa.cmdline"
        107⤵
        
        PID:4404
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES81D8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc788685818E9F454D9F7E5E2AA58EEA52.TMP"
        108⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        107⤵
        
        PID:1952
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\t_tonuid.cmdline"
        108⤵
        
        PID:2008
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES82C3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1486FBF7DAB49FE820E247424D7BDD.TMP"
        109⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        108⤵
        
        PID:2296
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\s_gsdkts.cmdline"
        109⤵
        
        PID:6068
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES83CC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA5DEAED96A32413B91B0C274131BA051.TMP"
        110⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        109⤵
        
        PID:1660
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nwrpjl8s.cmdline"
        110⤵
        
        PID:2476
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES84D6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB2A150245799467CB44BFE90E26346E.TMP"
        111⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        110⤵
        
        PID:2352
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gphamvbl.cmdline"
        111⤵
        
        PID:1408
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES85C0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB214DF3ED25746938F115B50D921AE9D.TMP"
        112⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        111⤵
        
        PID:1772
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z850xvyu.cmdline"
        112⤵
        
        PID:5972
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES869B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc331202647C684073A53F7A59EB62C10.TMP"
        113⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        112⤵
        
        PID:3844
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\j1tfqmcr.cmdline"
        113⤵
        
        PID:3728
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8766.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc44A29BFB465D4E2CA3D2DDA3BEDFC6DC.TMP"
        114⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        113⤵
        
        PID:4240
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gcg-rgnp.cmdline"
        114⤵
        
        PID:2504
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8841.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc79099B9A876344AB9088A1A1684569E.TMP"
        115⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        114⤵
        
        PID:5496
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qcaed-ol.cmdline"
        115⤵
        
        PID:5244
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES890C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB0B187524A85404EAC65B9F666695B0.TMP"
        116⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        115⤵
        
        PID:3328
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qhcavhqu.cmdline"
        116⤵
        
        PID:2716
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES89E7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAA712733924C4E55B0459FFEAF49FB3.TMP"
        117⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        116⤵
        
        PID:5864
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ij4-bwvi.cmdline"
        117⤵
        
        PID:2512
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8AD1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9DD654B9A0994D9883688AF3D02F584.TMP"
        118⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        117⤵
        
        PID:3172
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\omairzak.cmdline"
        118⤵
        
        PID:2976
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8BAC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc71BD8AA5C92A4BF594AABBC5ED21B76.TMP"
        119⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        118⤵
        
        PID:2432
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fuu6iaa2.cmdline"
        119⤵
        
        PID:3008
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8CA6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc53B38F76F5B54EA28F1530E5B2259152.TMP"
        120⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        119⤵
        
        PID:2524
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fwpmlqty.cmdline"
        120⤵
        
        PID:5540
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8D81.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6CD63CDBAF4147CDBB5C7FF08DCF260.TMP"
        121⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        120⤵
        
        PID:2844
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\did21fdo.cmdline"
        121⤵
        
        PID:3792
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E5B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6254E5E13B7344CB99FB90D230EB813.TMP"
        122⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        121⤵
        
        PID:2628
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mymotciy.cmdline"
        122⤵
        
        PID:2492
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F36.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2D80F9FB975247AC8074B421B305470.TMP"
        123⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        122⤵
        
        PID:3340
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ha1d-7a9.cmdline"
        123⤵
        
        PID:4852
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9011.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2A8C7B1A376E44B7A1B02FB91D3B941.TMP"
        124⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        123⤵
        
        PID:936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nlzi9qpp.cmdline"
        124⤵
        
        PID:2056
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES90EC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6ED6A7AC80554FA191A48B2854B42DFE.TMP"
        125⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        124⤵
        
        PID:4740
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q4btjcyj.cmdline"
        125⤵
        
        PID:2220
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES91B7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD98B3576A57A494D94A6FE60C396FAB1.TMP"
        126⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        125⤵
        
        PID:5392
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r5vbkle0.cmdline"
        126⤵
        
        PID:5704
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9292.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDD63EC66FF8458BBBE4A675751D690.TMP"
        127⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        126⤵
        
        PID:5376
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\znyh7rhh.cmdline"
        127⤵
        
        PID:3748
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES936C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8FE48114596E46178C2A2DC621F172B.TMP"
        128⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        127⤵
        
        PID:2184
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wbhlq-p5.cmdline"
        128⤵
        
        PID:1988
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9466.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4E30E79E9BC34DE7BFFC3B8B64439279.TMP"
        129⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        128⤵
        
        PID:5008
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_zylega6.cmdline"
        129⤵
        
        PID:5204
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9541.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc24D268FD8705436B80BC2F906FBBC1FF.TMP"
        130⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        129⤵
        
        PID:3720
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rse_ogpo.cmdline"
        130⤵
        
        PID:5760
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES963B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE291A0C02BB049EF989466033917EAE.TMP"
        131⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        130⤵
        
        PID:4296
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q4bgd9yj.cmdline"
        131⤵
        
        PID:4744
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9725.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4CFD892170E149F5A533BCFD34804139.TMP"
        132⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        131⤵
        
        PID:2860
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\34suarrd.cmdline"
        132⤵
        
        PID:5188
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        133⤵
        
        PID:4916
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES982F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6AFECD08290741CBB9E5302BD8B34BCB.TMP"
        133⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        132⤵
        
        PID:3136
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7ldu0nqr.cmdline"
        133⤵
        
        PID:4940
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES990A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc557130C85A19442093E29212AC528633.TMP"
        134⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        133⤵
        
        PID:5952
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0sazflp0.cmdline"
        134⤵
        
        PID:2468
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES99F4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc41765540BDFB4F899B989198B1D12EBA.TMP"
        135⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        134⤵
        
        PID:3256
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\g_4ldbbf.cmdline"
        135⤵
        
        PID:2768
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9ADF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc96D9B3C3FF6944D78DB322601F142CB4.TMP"
        136⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        135⤵
        
        PID:4952
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\plcr1-kp.cmdline"
        136⤵
        
        PID:4564
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9BB9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4B8818D29D244AE299F1758DDD1F56D0.TMP"
        137⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        136⤵
        
        PID:792
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5yajpazf.cmdline"
        137⤵
        
        PID:5548
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9CA4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc92A444414716413BA58A46083C96DA4.TMP"
        138⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        137⤵
        
        PID:5356
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q1lgrjrv.cmdline"
        138⤵
        
        PID:2404
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D7E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6D2825B47B944DE2B49786EF97C1C7A1.TMP"
        139⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        138⤵
        
        PID:2508
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jfwobmld.cmdline"
        139⤵
        
        PID:2880
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E59.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC6545E5087B84C3E8DD6450A3A7A9AD.TMP"
        140⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        139⤵
        
        PID:5404
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f5ycvq1i.cmdline"
        140⤵
        
        PID:4424
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9F34.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc40CCB9E465294C7783A6491D70FC4BBC.TMP"
        141⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        140⤵
        
        PID:1160
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\t5g8vw2m.cmdline"
        141⤵
        
        PID:1220
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA01E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEF40156D9B68457DA38E5F891C5A7BA.TMP"
        142⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        141⤵
        
        PID:4732
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l1tlbiaa.cmdline"
        142⤵
        
        PID:2160
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA109.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7CF0AB9FC12A4C53B4557866396CDBA7.TMP"
        143⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        142⤵
        
        PID:4148
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\c81bvy6l.cmdline"
        143⤵
        
        PID:1968
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA203.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc71D22C477604B038544E0106705257.TMP"
        144⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        143⤵
        
        PID:3424
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gfqetd-c.cmdline"
        144⤵
        
        PID:3756
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA2ED.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4CECFD78D57F45BBB15FB3E9B54B62A8.TMP"
        145⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        144⤵
        
        PID:1632
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vs3vguyj.cmdline"
        145⤵
        
        PID:5740
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA3D7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2DF636DA42D2425AAD12EC2812A63B6D.TMP"
        146⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        145⤵
        
        PID:3472
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7uay4a4e.cmdline"
        146⤵
        
        PID:3204
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA4C2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6C28D3E56DEC4EBD871CC62B6148CCB.TMP"
        147⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        146⤵
        
        PID:4728
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\h9hu6b94.cmdline"
        147⤵
        
        PID:1996
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        148⤵
        
        PID:3012
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA58D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD959E888CFE3412EBC73715EABAE2AC.TMP"
        148⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        147⤵
        
        PID:1464
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\easp6gih.cmdline"
        148⤵
        
        PID:4652
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA677.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE739624E9F2649BB99A9C7F9B17C91.TMP"
        149⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        148⤵
        
        PID:5872
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3uatjrdj.cmdline"
        149⤵
        
        PID:2408
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA752.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc21F861422D3D4EB9B6FE2A55F67C9BA6.TMP"
        150⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        149⤵
        
        PID:1596
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pkn1t8gt.cmdline"
        150⤵
        
        PID:1780
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA84C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1E802E8F6251492F802C972B64EA14C.TMP"
        151⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        150⤵
        
        PID:5372
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hluq_h5e.cmdline"
        151⤵
        
        PID:5464
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA956.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEB35B511908A4A0384DD71C0EDC91A6F.TMP"
        152⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        151⤵
        
        PID:1764
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\b2lmprmg.cmdline"
        152⤵
        
        PID:1396
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        153⤵
        
        PID:5104
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA9E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1891689E329046A1B2EEFA48E0EBC0.TMP"
        153⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        152⤵
        
        PID:2920
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nqldlxfg.cmdline"
        153⤵
        
        PID:4472
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESABC7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1EF202B39F084DC1BA5E678AED2AC70.TMP"
        154⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        153⤵
        
        PID:1420
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fovzdezm.cmdline"
        154⤵
        
        PID:2644
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESACF0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1A0FC5E213F2454BB8ED3E13599F93CD.TMP"
        155⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        154⤵
        
        PID:704
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xivx3sgs.cmdline"
        155⤵
        
        PID:1812
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE09.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc56BE71A56A649D298F37A5E951395F9.TMP"
        156⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        155⤵
        
        PID:4920
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u9y1qq5d.cmdline"
        156⤵
        
        PID:6096
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF22.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc840F6074A574185B26973401BD5332.TMP"
        157⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        156⤵
        
        PID:2464
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8vkxs_mq.cmdline"
        157⤵
        
        PID:2700
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        158⤵
        
        PID:1084
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB06A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF04610D15C54F71B6CB7361C4317CF.TMP"
        158⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        157⤵
        
        PID:5980
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fjumat-7.cmdline"
        158⤵
        
        PID:5884
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB1A3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc37DEB2D0F223494BA93C8D2F1A8D84.TMP"
        159⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        158⤵
        
        PID:2036
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\klczrsnd.cmdline"
        159⤵
        
        PID:2708
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB2DB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE20E71DF74F4457A95DB9B0B60DE60.TMP"
        160⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        159⤵
        
        PID:2872
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\j6nw0rhq.cmdline"
        160⤵
        
        PID:600
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB3F4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2EE2E588A2D430CAD987A67207D1E12.TMP"
        161⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        160⤵
        
        PID:1628
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hj894umh.cmdline"
        161⤵
        
        PID:1496
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB4FE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD91C3C7510ED44308CEC603A8DB05341.TMP"
        162⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        161⤵
        
        PID:472
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lfj3eq8n.cmdline"
        162⤵
        
        PID:1884
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB5E8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAD0600AE7D8B4DA0B2F1F5A98651785E.TMP"
        163⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        162⤵
        
        PID:4144
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\a1sboy6o.cmdline"
        163⤵
        
        PID:4628
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB702.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDA9961C453CE453F96FE2FBA277EBBB.TMP"
        164⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        163⤵
        
        PID:5024
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\b1xbm8tu.cmdline"
        164⤵
        
        PID:5480
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB80B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2FD3C85F2A4A4E25A32F4E2EBFD26D8.TMP"
        165⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        164⤵
        
        PID:3280
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\i-ydic-h.cmdline"
        165⤵
        
        PID:2536
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB8E6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE54006672CE24FC3874DB0DE2E755ADE.TMP"
        166⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        165⤵
        
        PID:724
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7m9jvwtw.cmdline"
        166⤵
        
        PID:2984
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB9D0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDD63D8498C7B4F9CB7C02DC8296926F5.TMP"
        167⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        166⤵
        
        PID:5444
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vkulel5v.cmdline"
        167⤵
        
        PID:4856
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBACA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc673A18B87417401F9B2792B9E87D15BE.TMP"
        168⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        167⤵
        
        PID:4796
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\c17vn4qx.cmdline"
        168⤵
        
        PID:4708
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBBD4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc400F75FA7CFB40B889BDF4A65C187C30.TMP"
        169⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        168⤵
        
        PID:1388
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\goserhd1.cmdline"
        169⤵
        
        PID:2604
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBCCE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB8E0366B3785484A935BA8D55631B12A.TMP"
        170⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        169⤵
        
        PID:3804
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fsxblvpq.cmdline"
        170⤵
        
        PID:5924
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBDD8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6ADB019E45D84B1F85FFEDE8B62ACA2E.TMP"
        171⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        170⤵
        
        PID:2800
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\97terexh.cmdline"
        171⤵
        
        PID:4692
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBEE1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC64CC8E5DADB4DE9AE4B949D116C26F3.TMP"
        172⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        171⤵
        
        PID:6080
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vwsxw8dx.cmdline"
        172⤵
        
        PID:4140
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBFEB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD2AFDF518F3745EC8B4E9B42B88EFA70.TMP"
        173⤵
        
        PID:204
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        172⤵
        
        PID:476
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mtwhum0r.cmdline"
        173⤵
        
        PID:3120
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        174⤵
        
        PID:3972
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC104.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA6BA0B147F0A4C55BEA0BEEE527D6FDB.TMP"
        174⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        173⤵
        
        PID:560
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\do2dam1f.cmdline"
        174⤵
        
        PID:4768
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC21D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2F597E28E9124B239D5781716F753943.TMP"
        175⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        174⤵
        
        PID:3912
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6h-r-vzx.cmdline"
        175⤵
        
        PID:3768
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC337.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA2AFFD139DDB4444BB92215FC3F7A5D0.TMP"
        176⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        175⤵
        
        PID:4716
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\knosdxzv.cmdline"
        176⤵
        
        PID:4364
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC431.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc465E64CA36114322BB2BA6FAF1E411D0.TMP"
        177⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        176⤵
        
        PID:5604
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fvnyn8kp.cmdline"
        177⤵
        
        PID:4584
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC53A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF398FDBAC2C34D658DF9C290CAB0C11B.TMP"
        178⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        177⤵
        
        PID:548
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pxkrs30l.cmdline"
        178⤵
        
        PID:3944
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC654.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc56FD483745874BBF8A318FC84C6A782D.TMP"
        179⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        178⤵
        
        PID:1224
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gifltkia.cmdline"
        179⤵
        
        PID:5964
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC75D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc10F7219EF8CF4D9F9982F459D3A7AB4E.TMP"
        180⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        179⤵
        
        PID:2440
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7yop4gsy.cmdline"
        180⤵
        
        PID:4632
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC896.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc749F424749D24380BF359AFD3D1F2EE5.TMP"
        181⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        180⤵
        
        PID:3820
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sqllrcap.cmdline"
        181⤵
        
        PID:3168
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC990.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5F6C2B9EB2DD45BB981BCDBB693D66C.TMP"
        182⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        181⤵
        
        PID:1360
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l96q5jxx.cmdline"
        182⤵
        
        PID:6028
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCA6A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2A98D1F3AF83498DB617CC345A9A7325.TMP"
        183⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        182⤵
        
        PID:1060
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9371lqtd.cmdline"
        183⤵
        
        PID:4396
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCB84.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc146E28D27AB476199CA2AA08FEAB1EC.TMP"
        184⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        183⤵
        
        PID:2000
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gjq4ska-.cmdline"
        184⤵
        
        PID:4556
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC4F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4725E7F3E6944A128616F2E8BFF6C845.TMP"
        185⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        184⤵
        
        PID:2452
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\g--ig9c1.cmdline"
        185⤵
        
        PID:4724
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD39.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB7BD92E62F8F4C2BAFEE7EEE88F1B52.TMP"
        186⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        185⤵
        
        PID:1668
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gmkz0q3j.cmdline"
        186⤵
        
        PID:1976
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE62.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE766836C97604656A45453F1A9CD94E9.TMP"
        187⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        186⤵
        
        PID:5828
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zgkboxow.cmdline"
        187⤵
        
        PID:4924
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF4C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5BD5CE5D556645CAB1E41F248755E6CE.TMP"
        188⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        187⤵
        
        PID:4288
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gsvgfy9v.cmdline"
        188⤵
        
        PID:620
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD046.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC4C072A9DDDF49E487DE387673DB6E6A.TMP"
        189⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        188⤵
        
        PID:5824
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vn_dnhrd.cmdline"
        189⤵
        
        PID:6036
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD131.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC3D31DA642A9494ABB989665F5EAF7F8.TMP"
        190⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        189⤵
        
        PID:5340
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sy1zk7cw.cmdline"
        190⤵
        
        PID:1092
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD20C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF76A5F37A1DC42508FFACE9A52106393.TMP"
        191⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        190⤵
        
        PID:1444
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\48xicpi1.cmdline"
        191⤵
        
        PID:2240
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD315.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE9A8250C991848419EDF3B2EED5CB43.TMP"
        192⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        191⤵
        
        PID:4704
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jrwunmb1.cmdline"
        192⤵
        
        PID:4572
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD400.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9CD55376FA964B088443164D7C88B710.TMP"
        193⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        192⤵
        
        PID:4988
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vlmb5xf8.cmdline"
        193⤵
        
        PID:124
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD4EA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2C9A39AFC7D34C70AEB6CBC9CCD53641.TMP"
        194⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        193⤵
        
        PID:5552
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kcbaqmr_.cmdline"
        194⤵
        
        PID:1252
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD5D4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc972DC1D4FEE74D388CFF51F473A7F6D7.TMP"
        195⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        194⤵
        
        PID:4468
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\x7zgkqxy.cmdline"
        195⤵
        
        PID:4084
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD6CE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9CDDD4B9C49244F1AF99171E88F62DD4.TMP"
        196⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        195⤵
        
        PID:5352
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ur6srvfn.cmdline"
        196⤵
        
        PID:5364
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD7B9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc55A2350954B549968EB620B0B87B5D30.TMP"
        197⤵
        
        PID:204
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        196⤵
        
        PID:4292
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oyju9cnj.cmdline"
        197⤵
        
        PID:2936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD884.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc91E26605C6454AF7AC799D96EC4955EE.TMP"
        198⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        197⤵
        
        PID:4600
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mtwjsbzh.cmdline"
        198⤵
        
        PID:5920
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD96E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc294EC7EBC57D40B09CA2984925AEA6B.TMP"
        199⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        198⤵
        
        PID:3416
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bymxcwbx.cmdline"
        199⤵
        
        PID:3152
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA68.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7ECAAA3CA2D44FC6A26C9C75227265E.TMP"
        200⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        199⤵
        
        PID:4964
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hajgs0xa.cmdline"
        200⤵
        
        PID:4492
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDB33.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA4DF58F846BC47AE8AB9BDF32F91C321.TMP"
        201⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        200⤵
        
        PID:2992
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dfxkfmoo.cmdline"
        201⤵
        
        PID:2996
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDC0E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc70A720C6AFEE4174B2F6CFF46798054.TMP"
        202⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        201⤵
        
        PID:5112
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\owwhd5gc.cmdline"
        202⤵
        
        PID:892
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDCE9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8ACC9898137E4C69AD70589DC13BCE4B.TMP"
        203⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        202⤵
        
        PID:2660
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ziy3kuyk.cmdline"
        203⤵
        
        PID:1304
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDDB4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc439B4D72E0264A78A637CDF97E754F3.TMP"
        204⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        203⤵
        
        PID:3400
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ajajujuo.cmdline"
        204⤵
        
        PID:700
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE8F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA3511F0EE314B4E97501B3CEA5F4884.TMP"
        205⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        204⤵
        
        PID:6116
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\znwyv2-j.cmdline"
        205⤵
        
        PID:2640
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDF69.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6AFC651FFF4845AE99101B83E13E305F.TMP"
        206⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        205⤵
        
        PID:2112
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\te9xdehb.cmdline"
        206⤵
        
        PID:3388
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE025.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3E46D42B29A145A794D554537FA45B5.TMP"
        207⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        206⤵
        
        PID:4780
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yxazcyey.cmdline"
        207⤵
        
        PID:5168
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE10F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc48D5C5B09D8A4E8F9938E534FD4D01E.TMP"
        208⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        207⤵
        
        PID:2912
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ebf9a4if.cmdline"
        208⤵
        
        PID:2576
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE209.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc388B03F51D56425B9D694D3AD2288089.TMP"
        209⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        208⤵
        
        PID:5796
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sromhnpv.cmdline"
        209⤵
        
        PID:916
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE2D4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7D3CDFD3498D4531BE91D4DFC8965AA1.TMP"
        210⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        209⤵
        
        PID:1948
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\it0aqvsj.cmdline"
        210⤵
        
        PID:5684
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE3AF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc97A9E93350F44F3DB4E46B5E9ADB178.TMP"
        211⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        210⤵
        
        PID:4360
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2ifmrwkh.cmdline"
        211⤵
        
        PID:5628
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE48A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD53B5EDDB984ED08D3889C7CCFCD5A8.TMP"
        212⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        211⤵
        
        PID:2772
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sxftcoor.cmdline"
        212⤵
        
        PID:1072
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE574.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc719B961E63F0404BBD82BDB3EE35EBB.TMP"
        213⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        212⤵
        
        PID:3228
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wonawlya.cmdline"
        213⤵
        
        PID:1820
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE64F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc30F74164AF924851BB44905D124AF0EC.TMP"
        214⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        213⤵
        
        PID:1872
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5aticwkl.cmdline"
        214⤵
        
        PID:2568
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE72A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc413C44B3BF4491588EFD1A6592EE1C9.TMP"
        215⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        214⤵
        
        PID:4808
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\in68dzbz.cmdline"
        215⤵
        
        PID:5568
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE7F5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc552CF54D8D4E447382839C285AB187CB.TMP"
        216⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        215⤵
        
        PID:2416
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nnsk9blp.cmdline"
        216⤵
        
        PID:5016
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE8C0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB6757CC4BB9840FE83223687F6FC40C2.TMP"
        217⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        216⤵
        
        PID:5052
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tpsvirbu.cmdline"
        217⤵
        
        PID:2028
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE9BA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCCA6583AD9E845F4B52EB24C3F16A.TMP"
        218⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        217⤵
        
        PID:1928
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\m83mv_oj.cmdline"
        218⤵
        
        PID:4192
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEA95.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3C1A142FD9A641DA8F553480A0265EA8.TMP"
        219⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        218⤵
        
        PID:3652
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ewz_bdal.cmdline"
        219⤵
        
        PID:1228
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEB7F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc61C8DA96819745C6A7AB6DC6299D7DF9.TMP"
        220⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        219⤵
        
        PID:4860
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vmjes2qt.cmdline"
        220⤵
        
        PID:1192
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC4A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc176A05406BA744B3BAC758FD822A4C4E.TMP"
        221⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        220⤵
        
        PID:944
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kry-c0p_.cmdline"
        221⤵
        
        PID:5912
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESED15.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4ED1CC348367412DA4E550D1A7C7A524.TMP"
        222⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        221⤵
        
        PID:2564
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\c_dlavk6.cmdline"
        222⤵
        
        PID:2092
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEDF0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc57610DA642C94D0D9F2C9FEDC276584.TMP"
        223⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        222⤵
        
        PID:5936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0pao8gwa.cmdline"
        223⤵
        
        PID:3224
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEEBB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3EAAB136277341328629F12D493CB8D.TMP"
        224⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        223⤵
        
        PID:5264
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l7a7gmi0.cmdline"
        224⤵
        
        PID:1852
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF96.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD6A645A3F45D4606938C6DA70ADCCBA.TMP"
        225⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        224⤵
        
        PID:5240
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\aonwixx4.cmdline"
        225⤵
        
        PID:5804
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF080.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc96900110406E41DEAA205B404961EF7C.TMP"
        226⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        225⤵
        
        PID:4872
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r0tpstbe.cmdline"
        226⤵
        
        PID:1372
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF15B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFF541BA664F8491CA153F3B57A56DEB.TMP"
        227⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        226⤵
        
        PID:6020
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9c4ltrnt.cmdline"
        227⤵
        
        PID:4112
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF236.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD7BCA18F96D4214AD2296ADEE84B4E6.TMP"
        228⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        227⤵
        
        PID:5948
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z86kkqyv.cmdline"
        228⤵
        
        PID:3020
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF311.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE14B1093691F49C2B432E34357D4CE8.TMP"
        229⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        228⤵
        
        PID:1724
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9udz_v_e.cmdline"
        229⤵
        
        PID:108
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF3EB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc22ECF00D6AED44D89D8B25AE86C5AF9C.TMP"
        230⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        229⤵
        
        PID:3364
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-srzvugc.cmdline"
        230⤵
        
        PID:2560
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF4C6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6A932BB6FF5646A488451612F490C842.TMP"
        231⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        230⤵
        
        PID:5096
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pmoisr3k.cmdline"
        231⤵
        
        PID:2292
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF5B1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc40AF973DAA5C41B18F82A12EB681884.TMP"
        232⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        231⤵
        
        PID:2228
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\s34hoy2j.cmdline"
        232⤵
        
        PID:3016
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF68B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC2B3A4A1160C42FBA03F311617C295E2.TMP"
        233⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        232⤵
        
        PID:2904
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gf-marsq.cmdline"
        233⤵
        
        PID:2584
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF766.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFC79340FD1744C87869E79AB893A61C.TMP"
        234⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        233⤵
        
        PID:4640
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\w76ex-v_.cmdline"
        234⤵
        
        PID:3272
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF841.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB8409B6CA0E74D428A6B66196D96AD1A.TMP"
        235⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        234⤵
        
        PID:3436
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vakdoezk.cmdline"
        235⤵
        
        PID:804
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF90C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc15593EA149A243DB8C48F9F0D71662F.TMP"
        236⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        235⤵
        
        PID:256
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u_jmytn0.cmdline"
        236⤵
        
        PID:2596
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF9E7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9C2BBAE1E571458E983B5D226235A157.TMP"
        237⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        236⤵
        
        PID:5256
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kpnhh5ij.cmdline"
        237⤵
        
        PID:3160
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFAC1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc37A9434C369543C98DF64EBCA11B5CE.TMP"
        238⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        237⤵
        
        PID:5836
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-lvpmcxz.cmdline"
        238⤵
        
        PID:4356
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB9C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2B4CBC988637444284C5FD3B1081C2A.TMP"
        239⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        238⤵
        
        PID:3540
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nqv5expn.cmdline"
        239⤵
        
        PID:1296
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC58.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCF2B89AEF8454C1296B4661A148CF84.TMP"
        240⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        239⤵
        
        PID:3260
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fmsikacs.cmdline"
        240⤵
        
        PID:5616
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD32.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc56609CC0BD5A4C17927587899BF8F2.TMP"
        241⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        240⤵
        
        PID:5360
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f8uoh2po.cmdline"
        241⤵
        
        PID:2172
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE0D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4B3622B0327147A0B131C4BF6438FD.TMP"
        242⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        241⤵
        
        PID:1088
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z5ja19km.cmdline"
        242⤵
        
        PID:300
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFED8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFA23E78EEE804E87B68892C21C22248B.TMP"
        243⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        242⤵
        
        PID:4668
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ce9owkds.cmdline"
        243⤵
        
        PID:5860
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFA3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC9985BBA56884A94B830252D5EFCCE1A.TMP"
        244⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        243⤵
        
        PID:3736
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gf4j5l1z.cmdline"
        244⤵
        
        PID:5500
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc15BAB67C73C04C629D5A78B1FF75FAC.TMP"
        245⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        244⤵
        
        PID:1076
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_exs5idm.cmdline"
        245⤵
        
        PID:1152
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES13A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc742EFD07C22B4A498FB3E9663C87A59.TMP"
        246⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        245⤵
        
        PID:2156
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6i5_hfbg.cmdline"
        246⤵
        
        PID:4260
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES205.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2D025AA46F64C33977026C7B6E7719.TMP"
        247⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        246⤵
        
        PID:4896
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\czxh0-gx.cmdline"
        247⤵
        
        PID:5692
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2D0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9D5FB578E78416BA69D656D82263D9A.TMP"
        248⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        247⤵
        
        PID:1700
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\txsk4n9n.cmdline"
        248⤵
        
        PID:2032
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3BA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC293947465954CE8BA1881432D6B1EBA.TMP"
        249⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        248⤵
        
        PID:3888
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ktpjv_ga.cmdline"
        249⤵
        
        PID:4428
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES476.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc932D3251303E454594E1F470843EC6F.TMP"
        250⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        249⤵
        
        PID:4332
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5qvaoh2s.cmdline"
        250⤵
        
        PID:2712
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES570.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc11B05F3C916C4406AF143FDA2B6F3F7.TMP"
        251⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        250⤵
        
        PID:2864
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kaznaoh3.cmdline"
        251⤵
        
        PID:3000
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES64B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcADCECA3887824C7B85BE9FC90AB951E.TMP"
        252⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        251⤵
        
        PID:2456
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5ih5kdig.cmdline"
        252⤵
        
        PID:4256
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES725.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3CFF659422A643CE91CCCF5EE19015A5.TMP"
        253⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        252⤵
        
        PID:3580
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\owdrkbfo.cmdline"
        253⤵
        
        PID:1932
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES810.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc45111546D87643C6913832C89039AE94.TMP"
        254⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        253⤵
        
        PID:2868
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tg2uv_ys.cmdline"
        254⤵
        
        PID:4788
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8EA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5274AAD7EAB544F0BB6229AFD9BBF86D.TMP"
        255⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        254⤵
        
        PID:3764
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\utnp5g8o.cmdline"
        255⤵
        
        PID:6128
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBC29A0729EFD49A6A6157A2D2A89451C.TMP"
        256⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        255⤵
        
        PID:764
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kpg-4zrs.cmdline"
        256⤵
        
        PID:1588
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF8EA2553BA12404B84E422552B9666D5.TMP"
        257⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        256⤵
        
        PID:5764
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lwbanpmt.cmdline"
        257⤵
        
        PID:2064
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB9A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc71D626E0BE044B8088B919A57B586D74.TMP"
        258⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        257⤵
        
        PID:1448
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8igrm2hr.cmdline"
        258⤵
        
        PID:3612
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC84.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD3D23523B60B41E599318DBE7FD236.TMP"
        259⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        258⤵
        
        PID:4488
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iepo9jq9.cmdline"
        259⤵
        
        PID:4316
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD7E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc274424D4475F4369829BF11E2ACB40D2.TMP"
        260⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        259⤵
        
        PID:1216
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xopofqcd.cmdline"
        260⤵
        
        PID:6012
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE69.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF30738E72F33456992A32032E1B7DF98.TMP"
        261⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        260⤵
        
        PID:4636
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dlwwdq6l.cmdline"
        261⤵
        
        PID:1056
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF72.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEB74340CBC0D41C2BAAFDE7088FB557.TMP"
        262⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        261⤵
        
        PID:6160
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\in6lenhi.cmdline"
        262⤵
        
        PID:6208
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES106C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCCD7F1392BC3422A8D18B260FA77122A.TMP"
        263⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        262⤵
        
        PID:6300
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pgpeaqbq.cmdline"
        263⤵
        
        PID:6348
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1166.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc52721D60857E4E8781DEFAA119D382E3.TMP"
        264⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        263⤵
        
        PID:6440
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xuxuw-n0.cmdline"
        264⤵
        
        PID:6488
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1251.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAE500EC217714B50A1132C83BDD7B1.TMP"
        265⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        264⤵
        
        PID:6580
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3l-bznsq.cmdline"
        265⤵
        
        PID:6628
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES133B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc47B9D7CDA174498490E6865B918CA522.TMP"
        266⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        265⤵
        
        PID:6720
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sb2aumpr.cmdline"
        266⤵
        
        PID:6768
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1416.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1FF4F808927D40FAB92A2669FD50C26A.TMP"
        267⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        266⤵
        
        PID:6860
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mcpojbe0.cmdline"
        267⤵
        
        PID:6908
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1510.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7ED0FF836CA2413A8B29ACDFA2E28430.TMP"
        268⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        267⤵
        
        PID:7000
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vyscqxci.cmdline"
        268⤵
        
        PID:7048
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1629.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD1E90614F134458D9D839CA2598A4A16.TMP"
        269⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        268⤵
        
        PID:7140
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ke9bhzas.cmdline"
        269⤵
        
        PID:6152
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1713.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc21E055A8D743409880FE7FA0D47DB.TMP"
        270⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        269⤵
        
        PID:6228
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nn2qciac.cmdline"
        270⤵
        
        PID:6236
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES17EE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc27267D01BB714214AA2B8E43A5DFE66A.TMP"
        271⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        270⤵
        
        PID:6400
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8ujkxeeh.cmdline"
        271⤵
        
        PID:6376
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES18D9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBA1FC917E8AA4E82B4BF45225DFD5DC3.TMP"
        272⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        271⤵
        
        PID:6540
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nsqaf8fn.cmdline"
        272⤵
        
        PID:6492
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES19D3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc84BC917ECD8A4214BE415411326DF340.TMP"
        273⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        272⤵
        
        PID:6688
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tlyqmcfl.cmdline"
        273⤵
        
        PID:6660
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1ADC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc60ED9F5BC14D42BB57778305DB392.TMP"
        274⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        273⤵
        
        PID:6844
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mr1szy9e.cmdline"
        274⤵
        
        PID:6856
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1BE6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4EBABB58304B4F1EBB3B595D23115B96.TMP"
        275⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        274⤵
        
        PID:6976
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pdyeycub.cmdline"
        275⤵
        
        PID:7028
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1D0F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc16057EFD5E7546ED8222C16F5470358.TMP"
        276⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        275⤵
        
        PID:7112
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\splgf78w.cmdline"
        276⤵
        
        PID:7156
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1EA5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB4EF3C2B132B4F2CAA964697D0231B43.TMP"
        277⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        276⤵
        
        PID:6188
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gyaqw1ul.cmdline"
        277⤵
        
        PID:5632
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1FDD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4DD0D4AA3E5A4F5F8DF1DEE7E5E87721.TMP"
        278⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        277⤵
        
        PID:6252
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\waav-biy.cmdline"
        278⤵
        
        PID:6408
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2126.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc75B29374ADB74925A3F1CE4C24CFBE45.TMP"
        279⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        278⤵
        
        PID:6456
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_gee_ebu.cmdline"
        279⤵
        
        PID:6292
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES22AC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE6101D98A84A4B188AF159FA8555FA19.TMP"
        280⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        279⤵
        
        PID:6464
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8gk6a6ht.cmdline"
        280⤵
        
        PID:6712
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2404.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc50955970A73341A38DD182CAAE687879.TMP"
        281⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        280⤵
        
        PID:6616
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\75zr5jgo.cmdline"
        281⤵
        
        PID:6800
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES258B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB249A40B4A6047379696F38B8899F25.TMP"
        282⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        281⤵
        
        PID:6744
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0-_xznja.cmdline"
        282⤵
        
        PID:6884
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2730.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBCE8BD7CF5FC4FB3BE4DC45F2A39868.TMP"
        283⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        282⤵
        
        PID:7084
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q4g3gtay.cmdline"
        283⤵
        
        PID:7160
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2879.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8361FFF56E9E428ABE9C2B2B79523673.TMP"
        284⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        283⤵
        
        PID:6216
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2vejralz.cmdline"
        284⤵
        
        PID:6272
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES29F0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5E39FA55796744D3B35598779C11B2A7.TMP"
        285⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        284⤵
        
        PID:6156
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yozwlxfo.cmdline"
        285⤵
        
        PID:6496
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2BA5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc78E6C340A6944536A461766BF98EE3E2.TMP"
        286⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        285⤵
        
        PID:6548
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zgh3ef8w.cmdline"
        286⤵
        
        PID:6596
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2CED.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB6093169BDE743718865A2DF7920AD25.TMP"
        287⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        286⤵
        
        PID:6504
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\poonl0xa.cmdline"
        287⤵
        
        PID:6740
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E83.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7823F426AF5C40DA8044C64E0F3A9DC.TMP"
        288⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        287⤵
        
        PID:6696
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q_mw3jsb.cmdline"
        288⤵
        
        PID:6960
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2FDB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDD56415821104871892CB8B07981E8E.TMP"
        289⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        288⤵
        
        PID:7064
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-t4fl9m9.cmdline"
        289⤵
        
        PID:7100
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3181.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9065A9F6FC60414391B18A44EF304ED3.TMP"
        290⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        289⤵
        
        PID:7012
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\clphkrlg.cmdline"
        290⤵
        
        PID:7004
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3356.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA6D2286C4EA045B3B6DBD3F012184691.TMP"
        291⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        290⤵
        
        PID:6372
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nifqfk6n.cmdline"
        291⤵
        
        PID:6172
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES345F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc482A50EBB5794888881F91878494D292.TMP"
        292⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        291⤵
        
        PID:6288
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1gokcdsq.cmdline"
        292⤵
        
        PID:6184
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3598.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6316540A640E4DF181896BDCA7B7AE9.TMP"
        293⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        292⤵
        
        PID:6468
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hxhn-idt.cmdline"
        293⤵
        
        PID:6404
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES371F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA0A051EF3D074141BE7D5CE1599E8874.TMP"
        294⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        293⤵
        
        PID:6592
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rvn4nwdm.cmdline"
        294⤵
        
        PID:6792
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3886.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcED72B0B2738949C19252671C542BFDD.TMP"
        295⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        294⤵
        
        PID:6928
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-qeswzpk.cmdline"
        295⤵
        
        PID:7056
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES39AF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD311F8B2FC4671A0198FB6CF219788.TMP"
        296⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        295⤵
        
        PID:5792
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xoocjuvd.cmdline"
        296⤵
        
        PID:4912
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B45.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc71797F92E51D42AC9DBADEA2611739C.TMP"
        297⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        296⤵
        
        PID:7088
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nfjcgf0d.cmdline"
        297⤵
        
        PID:6344
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C8D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBDB5516C60DF47DFB7FD8BE77BABE00.TMP"
        298⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        297⤵
        
        PID:6352
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lr1oaa-u.cmdline"
        298⤵
        
        PID:6260
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3DE5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc826D36D823A840918A5DAD4D7E77A0D3.TMP"
        299⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        298⤵
        
        PID:6680
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fmmp30o1.cmdline"
        299⤵
        
        PID:6788
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F4C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8382EDE7566448BFB82158BC36AB3B85.TMP"
        300⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        299⤵
        
        PID:6604
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dspp5a6h.cmdline"
        300⤵
        
        PID:6692
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4085.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA7DAD800D3BC41D8A4EA25F9F0C6C7.TMP"
        301⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        300⤵
        
        PID:6904
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kprgnkpo.cmdline"
        301⤵
        
        PID:7120
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES41BD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA5ED141F944445BA8368B4765F76159.TMP"
        302⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        301⤵
        
        PID:5508
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pxw3dals.cmdline"
        302⤵
        
        PID:6244
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES42E6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc10EADD817BB843F790B5A51D151559C7.TMP"
        303⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        302⤵
        
        PID:5636
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\eijcjyyu.cmdline"
        303⤵
        
        PID:6256
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES445D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5D4F152FECCA4630AFFBA2DA7C1E255.TMP"
        304⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        303⤵
        
        PID:6624
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l-3wx5wm.cmdline"
        304⤵
        
        PID:6412
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4603.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc213CAF3E3E043239427A3FF82121F96.TMP"
        305⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        304⤵
        
        PID:6508
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ol8f_xce.cmdline"
        305⤵
        
        PID:6912
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES477A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc23B36EAD3ED0495591396CFB55DEFD1D.TMP"
        306⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        305⤵
        
        PID:6772
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lfanfwxr.cmdline"
        306⤵
        
        PID:6812
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4884.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD0CE43586227489990EFDD22523DBF70.TMP"
        307⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        306⤵
        
        PID:7024
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mtevj1js.cmdline"
        307⤵
        
        PID:7148
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES49AD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2439F4747C4F6D9E2B98B3EB272E.TMP"
        308⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        307⤵
        
        PID:6176
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hn-djf1f.cmdline"
        308⤵
        
        PID:6512
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4AC6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7A1724D7AF7D495CB5F12873CF6F998.TMP"
        309⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        308⤵
        
        PID:2068
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sn3cu2ou.cmdline"
        309⤵
        
        PID:6420
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C4C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2356EC96511B483BB88CB51655778563.TMP"
        310⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        309⤵
        
        PID:6240
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4slcngfd.cmdline"
        310⤵
        
        PID:6448
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D85.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc78BA35A547D345C8BAA88A42685D39F1.TMP"
        311⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        310⤵
        
        PID:6576
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ecnm7mov.cmdline"
        311⤵
        
        PID:6016
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E9E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc59A931E98B434E98AF65DA39E25A39A5.TMP"
        312⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        311⤵
        
        PID:7104
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yojtjmtt.cmdline"
        312⤵
        
        PID:7016
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5006.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc90B027B3A764104B310E7567ED59085.TMP"
        313⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        312⤵
        
        PID:6164
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pgb0ya_8.cmdline"
        313⤵
        
        PID:6312
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES518C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc62C1288DC797460094A9CE7A32BAD924.TMP"
        314⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        313⤵
        
        PID:5020
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9y8qf28e.cmdline"
        314⤵
        
        PID:6232
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5303.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2D19CC24F86B44C5917DFA5CDFCCBAE.TMP"
        315⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        314⤵
        
        PID:6556
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kretvlh6.cmdline"
        315⤵
        
        PID:6316
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5499.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC43B4FB3AA6E451EBF94A54D3EEA864.TMP"
        316⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        315⤵
        
        PID:6452
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wi265zpm.cmdline"
        316⤵
        
        PID:6932
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES566E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE3E10D281BC44614A1FA4DB860772697.TMP"
        317⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        316⤵
        
        PID:6944
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yvy_xiej.cmdline"
        317⤵
        
        PID:992
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5843.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC82811B1D2644078B56A9CB93C9445.TMP"
        318⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        317⤵
        
        PID:6784
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dmwh5ek5.cmdline"
        318⤵
        
        PID:6644
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES59F8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFF72178155734C1B9128CE0B262D61C.TMP"
        319⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        318⤵
        
        PID:6392
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iihtonaf.cmdline"
        319⤵
        
        PID:6684
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B7F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC44CC90AC2A4439D90BB8E1FA4B0B6DA.TMP"
        320⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        319⤵
        
        PID:6936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cadydgro.cmdline"
        320⤵
        
        PID:6968
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D15.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD1D9F26043CE4962BA3DE467A994D31C.TMP"
        321⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        320⤵
        
        PID:6840
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pnbak6b7.cmdline"
        321⤵
        
        PID:7108
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E8C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc31E05398EC8D4FC8A94B30F02BCE8E8.TMP"
        322⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        321⤵
        
        PID:5544
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l_iunhpl.cmdline"
        322⤵
        
        PID:7068
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5FC5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD42FE66C72342069986E45462D25E79.TMP"
        323⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        322⤵
        
        PID:6484
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xly_qts8.cmdline"
        323⤵
        
        PID:3004
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES614B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDE327039DE3647E2AA9BD47595D91366.TMP"
        324⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        323⤵
        
        PID:6416
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dqlpn4hj.cmdline"
        324⤵
        
        PID:6992
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES62C2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6DB335A27AC64CE59766BBE92439653.TMP"
        325⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        324⤵
        
        PID:6168
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kgyjdznd.cmdline"
        325⤵
        
        PID:6828
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES63FB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD2132624A1684730B681D53BAD14A0FF.TMP"
        326⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        325⤵
        
        PID:6248
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3qoijehb.cmdline"
        326⤵
        
        PID:6948
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6553.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCB4605D12EEF4FB784AE5CDD0D04134.TMP"
        327⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        326⤵
        
        PID:3040
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vnfy_buz.cmdline"
        327⤵
        
        PID:7096
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6708.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc86D0906967894AA09BB94C90912636.TMP"
        328⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        327⤵
        
        PID:6524
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1buk3zlr.cmdline"
        328⤵
        
        PID:6608
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6870.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCC9FF6FEAD484458907DF2A81CF3D16E.TMP"
        329⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        328⤵
        
        PID:6776
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7oklllv-.cmdline"
        329⤵
        
        PID:5784
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6989.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc227ECF3018BB415E94CB80C15790F09E.TMP"
        330⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        329⤵
        
        PID:6864
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v2oua4cx.cmdline"
        330⤵
        
        PID:1128
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6AD1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc286E5CAFB40E464F9ED9AC12ADF8218A.TMP"
        331⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        330⤵
        
        PID:5868
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cxqzplqi.cmdline"
        331⤵
        
        PID:7164
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C09.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8CC25144825C4E108BDB76AA2A408682.TMP"
        332⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        331⤵
        
        PID:4516
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zp6zq5jf.cmdline"
        332⤵
        
        PID:6756
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D32.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2BA174102A494EA19A8D261EA893366.TMP"
        333⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        332⤵
        
        PID:6432
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\o9kmwx08.cmdline"
        333⤵
        
        PID:6876
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E9A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB7A0E177471D449E979147149D2A3083.TMP"
        334⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        333⤵
        
        PID:6668
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\n5hlq33s.cmdline"
        334⤵
        
        PID:4520
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6FC3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE5127FBC5D1E49FE9B80FDD31EB8E8D.TMP"
        335⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        334⤵
        
        PID:6816
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pb7ipu2a.cmdline"
        335⤵
        
        PID:6480
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES711A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc300E031BA1754BB69154CE0DA6774F.TMP"
        336⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        335⤵
        
        PID:6868
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mtfjsybc.cmdline"
        336⤵
        
        PID:940
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES72A1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA6BA1E2D2624ED18E54658B531CC731.TMP"
        337⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        336⤵
        
        PID:6996
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wpvgycyq.cmdline"
        337⤵
        
        PID:6324
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES739B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc810B8CA6963A4B7E8D3F2CECFAD4924C.TMP"
        338⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        337⤵
        
        PID:7124
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xj9uonnk.cmdline"
        338⤵
        
        PID:6632
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7495.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE9D353BB98434860B53A8257D046F6.TMP"
        339⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        338⤵
        
        PID:6732
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3z7_b3yp.cmdline"
        339⤵
        
        PID:6708
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES759F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc54EC639537C24311BFFCCAF24DD2EBCD.TMP"
        340⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        339⤵
        
        PID:6752
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gxogh-xy.cmdline"
        340⤵
        
        PID:6724
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES76B8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8EC4DCFF9E954992976320219EB43DD.TMP"
        341⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qpv.exe
        340⤵
        
        PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

-srzvugc.dll

Path C:\Users\Admin\AppData\Local\Temp\-srzvugc.dll
Size 396KB
SHA256 87bb1c0c6538e894405c308c7b84c90d7b7ed712c0ff52c9a7065da504759da7
MD5 f731183e8c9f9e1ac37921557311f6f8
SHA1 cf9abda208349d886c3e204a0c60e7a7573fdeac
SHA512 987d0b0b9812ac6115a0e41569e3101dab29d913552f6a65c337975dd7ccab28c4b20f6e98b5a1c98aebc48ad513db69a2bb62f66385b2b8a7f99fcb3f49b530
SSDEEP 12288:rAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:cg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T16E84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17ndn4ix.cmdline

Path C:\Users\Admin\AppData\Local\Temp\17ndn4ix.cmdline
Size 138B
SHA256 58bacc1b3ee482802f232076dadb4e07bfae3d516582bff1abff8e8267cc8927
MD5 72feeaccb90e6a6f765a748357bf303b
SHA1 f0f0447ddb71545ddab1605b5ecd35b09ee2105c
SHA512 d5d90b1ddfcfa113f2619c439fa369f0838f0d4548792bfbd3237bc802aa1499bb3bae0aa4d90ff0cf68b9450abf78794141b5fbd521e2c080f6f62efda4cd9b
TLSH
T19EC09B13528BC71A95CF711B55F776AD80B15D4A7E853F104A50C45D5243509F787311
MD5 SHA1 SHA512 TLSH

Submit Download

17ndn4ix.dll

Path C:\Users\Admin\AppData\Local\Temp\17ndn4ix.dll
Size 396KB
SHA256 bc5a59b2bde06d3e2c46d2b98dd40d4bffd39b1fdead718ee01d8e1010f0680e
MD5 e139d4316926577fa9792f7d8ffbbc16
SHA1 2cba6e45c1d74fa379c2dfc6b619d0f804805299
SHA512 820d710e3b3b0e17561b8474afd324914ef77983c1fc6e7f47df91a391d2f24cbb6fa60c2bd602d5eefd46b4cd5c782d82fe9179467bd2c7d16f6fd01be71525
SSDEEP 12288:gAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:ng+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1C084482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29cypqhr.cmdline

Path C:\Users\Admin\AppData\Local\Temp\29cypqhr.cmdline
Size 138B
SHA256 d4243de9dca2a8fdf5e0a2edecf4eef92a01a46a8cf8bcd0829a1923638f2e71
MD5 93d3efa2c6f593d6d6e9a85306d02384
SHA1 e3173e83c80c05b0114b8df5fbb55fd1489bf3cf
SHA512 9a3299cbd2393919753a65e9b6868affa319e4f3b83b68525917fd52d123a690855c340a11c11749a8675bf8f556deca688b8cac831e1c59e80c211fc13e393a
TLSH
T1E3C02B05338FC22905C7501B05FC50DC81B15C0B3E013F101F00C54D2313D18BA83300
MD5 SHA1 SHA512 TLSH

Submit Download

29cypqhr.dll

Path C:\Users\Admin\AppData\Local\Temp\29cypqhr.dll
Size 396KB
SHA256 e9c8c2bb130fc0b9005cfafb4a7c87575d945b1e90df35a74273f0e8c641140b
MD5 8dbc3f42a97886057bc779e1af5f11b4
SHA1 0baa4a6ff60c7beceda7f388a72c1998589ae176
SHA512 edde58d005028ceed7f4d3377bfe46ac723247e03586e59621a260d8a1c21648e354139c68249b2f124688b89d8320d77a634aa3607c5e26b5c4fc569dc47e8c
SSDEEP 12288:UAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:zg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T17D84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3uatjrdj.dll

Path C:\Users\Admin\AppData\Local\Temp\3uatjrdj.dll
Size 396KB
SHA256 eb80e4c6fe2607950e880c24a74c9ff1bedd216d0df33b4cc30c326ae88d37f8
MD5 eb88bf788602cde5d5fd21fb8f89b3fc
SHA1 e3d249bfa311add9242886d7683ecd607cec8c09
SHA512 91d0ea598e54f14ec764f61ae7014e7cc8800fc96c13c00f42277af859e23c499b4d8de16f431579e80128b97f696fd4cfdedbcc12294e42f195937386ea2851
SSDEEP 12288:TAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Ug+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1E684482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ymqmkjs.cmdline

Path C:\Users\Admin\AppData\Local\Temp\3ymqmkjs.cmdline
Size 138B
SHA256 4ac0c45e37f03d155a94d732b6d1870d3778687437b0b82be1a21b4fe199e1a5
MD5 ce9cd2567378c7c373185a3657e3493f
SHA1 45bdc93b2d41f73b47a585ef9b167ca14e906631
SHA512 1acf5dd6ee167a79a66640c5440cbc64b8007e46c663a74dab236835ca284c9462cd63922cf52db32a2040ecef9596eaab688466499e3ecc0bb7f11f2f733da7
TLSH
T1C1C09B515387D67D25C5511F55F555DCD0F55D0F3E557F108650C4ED1243409B6C6322
MD5 SHA1 SHA512 TLSH

Submit Download

3ymqmkjs.dll

Path C:\Users\Admin\AppData\Local\Temp\3ymqmkjs.dll
Size 396KB
SHA256 2433bad1c4ca0cfe3f554b56e77691c64100e064a14ff4b00d6baa8b2af03b5b
MD5 b8b73c07b622ede40d8387ab18c2258f
SHA1 1d4d7b70cee634a1505e252eff11b45dae358db3
SHA512 666038f93a4f2d267f1ac8dfb427675d40f612582bc80dfbc92e1058143aa47e65612fd63800808bedc6b821b3e77cc5b250284ccb923214e221e971649a8919
SSDEEP 12288:qAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:9g+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1B884482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6urjpb6-.cmdline

Path C:\Users\Admin\AppData\Local\Temp\6urjpb6-.cmdline
Size 138B
SHA256 06396b9fc9307f5d60420be5bc2afbfbe6015ffaced15137ddcf518636820cce
MD5 8eeddcccd9b15bb060e03bd901536c3b
SHA1 e1da15e2d17ca9c687bf56dd6af8667ec2ff8e66
SHA512 619d65d2660fef8945651aec91bf4a5842cc284ec29b8342bf9a28a78046009e63c35ded87a5260f3531e07c46cb95b6efb09d152f9c22252c7880951da830a0
TLSH
T1B1C04C0552CAD6591585902B99B9519C90A1FD092A863B508770C45D129245AB6D224D
MD5 SHA1 SHA512 TLSH

Submit Download

6urjpb6-.dll

Path C:\Users\Admin\AppData\Local\Temp\6urjpb6-.dll
Size 396KB
SHA256 729907b3c5ed25a2aa081a3d14d923982a01e9ceaee7cb26e617e99ed9c2a3fd
MD5 41c3f89d0d0ec32b7f0edd263c05c4ea
SHA1 4fcbd2929cb79a48e23dcb8184911a9e28567055
SHA512 a379979691276625e49333c7eae33106c5f717d397d509b4fe6b71c8dc6ee325c115e0d965f2c32282f8d6e0fbd978590d1bcf8d697aa8b2a92c055b8f768c0f
SSDEEP 12288:fAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:og+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T19284482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8igrm2hr.dll

Path C:\Users\Admin\AppData\Local\Temp\8igrm2hr.dll
Size 396KB
SHA256 ee27bff70b991d8631bd68ce734261b2c4993a3abc19adef2e0725caa4531ef8
MD5 8ab0606b95e8a18256b2e585ee4a8775
SHA1 2bf4b0aa8f06c24f129b1095c11e44c428d787e7
SHA512 d50a5feaea162ce92478bdbd3960f8a8df7a8edec984150bcacde16dc06b3e1526ff43ca38b1c7d273e5ee5b76c3c7782b00b88390d907f6d793424674d1a9a9
SSDEEP 12288:ZAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:ug+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T16284482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ujkxeeh.dll

Path C:\Users\Admin\AppData\Local\Temp\8ujkxeeh.dll
Size 396KB
SHA256 3365d704fdd6dff3017bddc6b5e3db645f2bd4e6d1dbc052d1d6249c07936e00
MD5 0b256ed8a03ed90daab4cdd1fccc65b6
SHA1 516ecca477d336b33b6a548418c300be05a5a009
SHA512 3264710f51a9a0889d3789285a3390948e40816bc0944e5159c68e1eb4fb77ce1e9337e49f30aa3cc1f595c39f08f216f35810bfbb9becf6f23f6308815b2176
SSDEEP 12288:sAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:7g+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T16B84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97terexh.dll

Path C:\Users\Admin\AppData\Local\Temp\97terexh.dll
Size 396KB
SHA256 0eda8bd6bf41b65019c8b9a36a521be66236278698ce6e51a76ede78719c0b4f
MD5 97e533b1c07f5479df9d7509846ec785
SHA1 bbb97e8b5437e11e2f882a1d6c4dc1c8a98047ac
SHA512 db7348ffdb5ef7bc836e09a292cacdcea3c99535fcc8e0525f2aa350572d3419ca942ba190485064c73e3ca518e9d1750b530e9dc687585dcaa980fbbb72759b
SSDEEP 12288:fAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:og+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1F684482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

997rqfeq.dll

Path C:\Users\Admin\AppData\Local\Temp\997rqfeq.dll
Size 396KB
SHA256 dbf665ecf7067dbf17fafc4e7edcb92dc8243dcb2a20d004bd85aa38083c45da
MD5 cd8924c382eab2962ef1ad4ffaa7b4f8
SHA1 55cd15241f211c218c7661cc63e577944f34da66
SHA512 e4564e09fa207608197616e1750d5ec7f804cb78cff9672c30d836eb8702ac51ed1545cb34a61779c3441d6fd7b9de87d33ae1cc2ad2cf907477d08a86acc217
SSDEEP 12288:QAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:3g+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T14D84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9lu9dirr.dll

Path C:\Users\Admin\AppData\Local\Temp\9lu9dirr.dll
Size 396KB
SHA256 37d1ac51174b6e4c27f3eeacb5907368bccca151fb43099aa9b312f142a1372a
MD5 e1e6f58514c26c0297818957d2f49c9c
SHA1 c0d607c9ef602bbdcb2784e1bbc4dbf9ba88e852
SHA512 0d5af8f5d490604c3f274cde4ba11220394549c2bcf4c7dec3ef77bc76de1aebce2dfe3ea1865092c2d80c414bcde3c84249d9b0d0b2fa20ac9508a90de0ef24
SSDEEP 12288:hAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Gg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T17184482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES1004.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1004.tmp
Size 1KB
SHA256 91f37084bf5566aeaeb07f1ba0c8fb8a414414d0f46697047830003449f67d63
MD5 5d4d178b02845bec735dbfffabac6ddb
SHA1 1629b3ded5d1a554046f0d8a88e5a5031959cd64
SHA512 51f35b4570e65abb07a95e233ff591b3eb6e4a2b8df7c009237a27f3cfe83b2c07b72abf8b751b4ff0cad650465d15456539e91151213a63c6af809240c0e6e5
TLSH
T11D210A0553E9470EF077473169FA132BA239FDA4DFB2A39B854003692C51514EEB1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES117B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES117B.tmp
Size 1KB
SHA256 67b74a497ad944825b81d89137cff0b1e126a2ddeaf4ab2a50e1711740ec8abf
MD5 9e26eda6a0b7fbb77e855ffa5133b310
SHA1 cacfed7a96b4c281cce9a0d045df869202734bb2
SHA512 95608b2244ee7823a56510a47deda42a78e9e277e510afd72d9e063bfb24e44163e8a96c1d500d86fb97a86579b64bbd114730bcc2b2b23b44276ed00c9f63da
TLSH
T1BE21500557E8470FF0730B32A9F6132B9225FD54DFB1535F854402282C91554EE71A72
MD5 SHA1 SHA512 TLSH

Submit Download

RES12E2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES12E2.tmp
Size 1KB
SHA256 742ed98be6d606a21f57f13076b7e507e7489b4951f9013a11db20ff29ed8347
MD5 6fc38cf3e5bb8352a436c63dd791bd8c
SHA1 afb84e738fbccf003487e6c634251e329085b45f
SHA512 c08c57b4ab39e124e1a9cf1c5b78b8a80ca18b4fdf926af2bee814aba2c1f5ff8a27cda653450c4aabdc4fa2d69c9c33d17ca3b94a5592361b1a4c4fd9d78a69
TLSH
T1E721C00553E9470FF0B3473269FA132B9235FDA4DFB6935F848042281C52504EEB1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES1449.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1449.tmp
Size 1KB
SHA256 08adb62acfccf881fefe263ebd96052b2cb714efc7e817ff859b8f18e5ba537b
MD5 b652b866d1b71f64291ceb7e02d6cfb0
SHA1 24c51b6dce0dffd29dcf2c6bffe007783a460b28
SHA512 53f17b672f600da164b75c238b837592430491f09b1e1c5d94b8b825cecb4c05e064a25ed3df4ef4f4f023fe22face0b11491e3dd90260c5e534f84ee986a631
TLSH
T180219C0653E8070BF0774731A9FA132BD238FDA4CFB6A35F8441022C2CA1200EEB0A76
MD5 SHA1 SHA512 TLSH

Submit Download

RES1582.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1582.tmp
Size 1KB
SHA256 7bf8f334f7c645f0f8e4b17f57afad771fac97f92f60fe146c427f53b3528a1c
MD5 b2dcf7c8762c33b1376aa365d97d13d0
SHA1 d63d359247bc25a20a61ac67e045a0e903c0d83d
SHA512 b57ce03a5b05eafa8c53390d481ea0b4323f3e0b6b1eca41b3fe3c47ea0b0ab7ecde1a4db92042784da383135a7ed0301ef5960ce260863cbf7441fe6b4e783b
TLSH
T107213A0553E8470FF0B74B32A9F5232B9229FDA4DFB2935E844002692C52554EEB1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES16AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES16AB.tmp
Size 1KB
SHA256 a96bd253f82b6176a068210da320b40537bbe57eafc377c58df550a68706b82a
MD5 6845053ec971a3fa1219e036915a837a
SHA1 be668b474edfa11d21d0888e54f6116180f48049
SHA512 1d312180b73e14822d4894834b6f96cb9666bcfc878d3f3e0a60b55b156ce98deccad49642d20d9f56923cc25580aa699c58826e455256dfb5949ed09a58f02f
TLSH
T1A6212C0657E9470EF0B747327DF6572B9229FDA5DFB2A39B8480422C2C52114EEB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES17D4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES17D4.tmp
Size 1KB
SHA256 2153a3744490c8ea7954c0ef675e0ccde7bb0736b55d6857585a1fec0ec1f3c1
MD5 66bcb2dfa2fed76b3b3103af3eb6d0b1
SHA1 06f1b729c2321f0fae14ae197282926bd7b0f328
SHA512 98ad9ff596dc784ec3fd63fae2494cb640cbf824a77c53c7cbd2df6a75968bdfc3170248147d116173fd8889dff56f0e29a8ab7e4a3a18478ed01530fc769553
TLSH
T18F213A0963E8470AF4B7473169F6132BA228FDA4EFB2539B848003281C55550EEA1A72
MD5 SHA1 SHA512 TLSH

Submit Download

RES323.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES323.tmp
Size 1KB
SHA256 398e05aaaa38b83ef4f7d93ef448aff754e69a1e8569da73de7f5a79ddf7d4d3
MD5 81db4a95f2543738223590e199aba2fa
SHA1 c72e9a43723681bd3399e7ec73bca201da2b3861
SHA512 1d713fe03288da3e63bdcdb9eb141bbdfb1c55943b947cae0aa853afa8332869978c80d90e4890fb0a8d63568eca145602364642ba7853aa307baa1cc51af8bf
TLSH
T106218005A3E8470EF077473169F5132BA239FDA5EFB2975B858002291C51140EEB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RESBDD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBDD.tmp
Size 1KB
SHA256 a3aa5ad7e12e1ae5b22d90c003989546f115d15817076baffcdce5a2206644b1
MD5 ac13104b1373dd6e284e99c4814d3101
SHA1 30d2f5c6415fbe65414aa98abdf9d2d050674b57
SHA512 86a09f34331b34ef9582154a940d7d134bd240a181eb3fef4e3bed957e8d3447ad5eda65ff55b3dd68ec8f05757a14e50d8285e97008aeeaccfb9e72d363ab60
TLSH
T1C5213D0953E8471BF077473179F9136B9238FD65DFB1A35B8480021C2C51144EEB1A72
MD5 SHA1 SHA512 TLSH

Submit Download

RESD64.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD64.tmp
Size 1KB
SHA256 db4dac4aad62f7434401844dfd429f6e636aad33b49d2d5189b09cb5924f2a38
MD5 44e3cb7c871247b8de3b0f60cd0c6fdd
SHA1 313ec33ee0587c1d4bbf6cb3945fbc9149bbba0d
SHA512 d39b8d8a944a0b589adc6bcc9908f6460e7ba2f4e35253a2626fe4eb4fded1a688bdc759f8f4a217e6d66b4b5b03b827e14e0b4724e2079c74eb72a7eef259e2
TLSH
T1D821C00953E9470FF0B7473269F6132BA239FD94DFB2935F858002292C62140EEB0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESEDB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEDB.tmp
Size 1KB
SHA256 d3dd386a8d51c5cfd4a15c4c03c37cbe4e058bf3429cb4faaf6765765de07801
MD5 d2d3a918230c39ea324a112462f1d430
SHA1 31b74b3467490a91d5b2fda2b35ca7c78f8c11ff
SHA512 27714d94c928093d66966cd2525a8cf233ced399110dc7dc3a943d724aab96873a7d4bae2a4f2abb731907c74f695b37c112eb6c7acf8e0bc697580b99255c53
TLSH
T1EC21500553EC470EF4730B32B9FA136B9239FEE1DFB2935A8480422D2C51144EE71A72
MD5 SHA1 SHA512 TLSH

Submit Download

RESF855.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF855.tmp
Size 1KB
SHA256 e3b0e7fa85839eb77d4b5303fbb2ac12c15e9e07a158d53144d635c10807bc50
MD5 37ce50a64cf145a2f7701696101a20f6
SHA1 eaa4e7504d2dc3c0be7c3496f9712d7ec2d03cb9
SHA512 f56692048ed20ea5a7a320662b3f192d432e6dacf4fbad92625315d43c45702f253187e412f93a438284ba4cc1690ca84c7768e5d6e1c0da80acd50eb82cd75c
TLSH
T108213A0553EC470FF0774732F9F6132BA225FDA4DFB2675F859002281C92544EEA0A72
MD5 SHA1 SHA512 TLSH

Submit Download

RESFE12.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFE12.tmp
Size 1KB
SHA256 ca4f8734d135604dcba9afeb266ee50075d7437e071718adb8a9a9041f139bb3
MD5 69d1982a5d8fd36d4eedad15035701c7
SHA1 92c038dd308b0642ef56bf669b867aec4eeb8639
SHA512 32e1f5d84db8fdc4175925959dea87a78d5dc1fd375f0f4fa9ace799c1342dff7ed1cc367134e898e097c4aeb0bc0f7a4768873cf53ff006a660a82adcb270ff
TLSH
T129215C0963E8471FF0B78732B9F6132B9638FDA4EFB2935B858002681C51544EEB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

_ryd7ixz.dll

Path C:\Users\Admin\AppData\Local\Temp\_ryd7ixz.dll
Size 396KB
SHA256 6e05e1e496289787ae5fb0fa2249c3413f3a3e6c034c806e7b1cb5c70b343a72
MD5 25f64402ce7a7dd5c54c6d1d2ff8f4a1
SHA1 4eecd137ce1df6e0321488fd34d447760f644ae9
SHA512 a1f1d34cc0b2d88754265115776a1049582298aecf19e185315c8ab1b10b3663b8a8dd75e2fcd2887fceaa3c1f930d08b6e7b236bfe9039c783c2e26bb3c1790
SSDEEP 12288:1Ag6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:yg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T10D84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1sboy6o.dll

Path C:\Users\Admin\AppData\Local\Temp\a1sboy6o.dll
Size 396KB
SHA256 37c93281323dd6dc7b970428e762e10a4f4e8951d5f11437dadc40402a6d900e
MD5 0b757844970ea275c8aff1a8a8198cc4
SHA1 3474240680c331f2b6f7f1bb7273e1d50c79c00c
SHA512 38d5c5e3efac0f479364cf8ae6f2969857fc7baa5c86d1da6666ef02bfbb92c30afec370a615e89d2be0e1cb4294e53c56604b51395f88b5703a54e606d61aaf
SSDEEP 12288:xAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:2g+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T17584482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bkp5lw2p.cmdline

Path C:\Users\Admin\AppData\Local\Temp\bkp5lw2p.cmdline
Size 138B
SHA256 3d6465fb9894f753f429203a3dccce6ac4e63faad27661880edc26b87bab43f4
MD5 cb9973473546aa2acc166e4442cadb6d
SHA1 f501e9f653c99156dbe86a9f779ffa30670e527d
SHA512 de195207ea0bc1e7e7824bfc2f9f51444459271b95fc898279423935d52bc284534c8795c1c7a89e1c5972a9e514226564b1364081dcb55aec624d331c9bba56
TLSH
T103C09B0547C7C65D27C5501F95F5619C80F15D193E957F708A50ED5D124340AB6B2301
MD5 SHA1 SHA512 TLSH

Submit Download

c_0jhsoz.dll

Path C:\Users\Admin\AppData\Local\Temp\c_0jhsoz.dll
Size 396KB
SHA256 7cd9a327d77fbb878fe5b683f4bc9d286e0193592f9d96f5de6f5b79c4d3e9e6
MD5 e4efb7132c4b8ea6ab5cdfe334496368
SHA1 f08ec84f27b5a43e483275849717b199bf2e33e1
SHA512 02d32db10b55144df2f26eaf1c454115633edfb6e2c94c2aef51b714c6721c11aa4e1b451ad98e47a12a426f82163cb0743cc6411d1bac3ec351985aa90ac6fb
SSDEEP 12288:fAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:og+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1A984482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d55njt95.cmdline

Path C:\Users\Admin\AppData\Local\Temp\d55njt95.cmdline
Size 138B
SHA256 431478df485230f9b578e82a8bce9414c08b74bd939be67dc65c87939906e0bd
MD5 644cf4287ebfddf1cc29393a1978b3d8
SHA1 6af425bd280c0c25c871e73822a6b9197753963c
SHA512 3f3250ac95f097e726ab69adde5431e737b11ed62a86b93632e34340888fc8dc54ce9c41b645e5b0c9bcf1d2927c7d2ce8bb96a5b56460f2de0ed0f313e8d45a
TLSH
T1E2C09B454387C61E16D7502B55F5B1BCC1B26E093E993F504690C55D1243449B682351
MD5 SHA1 SHA512 TLSH

Submit Download

d55njt95.dll

Path C:\Users\Admin\AppData\Local\Temp\d55njt95.dll
Size 396KB
SHA256 712790ab4ad54f75a8ea28915056b42c007083c0804e08800466e81aa2f5fcef
MD5 28667f16573684c132d850726a94ccf0
SHA1 8db65e5ecf3a981153b837b29597da67c41523a1
SHA512 fc68c9d7f462648854eeff86390feebee087e9e60f5d033363e66b8627c0527319179c51586e1f8574708059815d88285d96f77124073aa7b5541eb59784b6c3
SSDEEP 12288:6Ag6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:tg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1FB84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dmyxcnix.cmdline

Path C:\Users\Admin\AppData\Local\Temp\dmyxcnix.cmdline
Size 138B
SHA256 4ca2dfe33723ee636b43ccd6febbe87fb169b1d706d516ec2efdaf206eceae86
MD5 a2529bf08f3a4e49eab63dc8e8d5def5
SHA1 dc46faff8241716a8185d8afe65cf89a10bf3cdf
SHA512 ac7f2444003f0391b057835c7fc19395472ec6e96a0abef0eba85284c09df4e5d4275acc55beb867b958a2f1f2cc35f153d52a147b6ff59bdc78b72188c3e935
TLSH
T1B7C09B02428BC61915C5D11B57F555AC84F15E0B7E573F119A70C45D165364AB682341
MD5 SHA1 SHA512 TLSH

Submit Download

dmyxcnix.dll

Path C:\Users\Admin\AppData\Local\Temp\dmyxcnix.dll
Size 396KB
SHA256 02b0d77928a625a6427af42b37b92e2540d839e80665c132be127225359fc603
MD5 1004679fa758ef7a8c1eb8d21214dbc8
SHA1 a2c956006c42352196dd6734a3cd17e2daafec8f
SHA512 aa3c0c2545e84a380cc275c70abefa787f8a89e6ebfd3ff3af9bac30f04bef2598888b4907716270cdbe242b56136021fca5d68a002b7fbba253f4c1e6b9930d
SSDEEP 12288:LAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:8g+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1DA84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5ycvq1i.dll

Path C:\Users\Admin\AppData\Local\Temp\f5ycvq1i.dll
Size 396KB
SHA256 406c1be60a999b04f4e74160d7941e4b3ef12f8b0fbe7b99f56da81d2106426f
MD5 3feee13a6ba40bf3817cca96af5cc51f
SHA1 67c333ffb13ca7e0110ef02f237d6425689bfd09
SHA512 c6a61fc41aed1595c1dbaa7fe088c90de8f79fda335e843412d22ba1cd0a78cbb0ce97dcf8025099a727331c302aafddd44258f80531f4ffb2264ad644bdecdc
SSDEEP 12288:XAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Qg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T14D84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fblo45p2.cmdline

Path C:\Users\Admin\AppData\Local\Temp\fblo45p2.cmdline
Size 138B
SHA256 7fd0a48e1b84e542d281fe09c5e619e560d7747cc61c39820fb52c129d64658a
MD5 c96051e7dc4d8edb9c2bdcf9d0f3e3b5
SHA1 068a4811dc7a518386a7464f0fdfadb8f16fc15e
SHA512 8aa1d21ec0d6ab8858fab3d487b2072b157d6c93d3af97882ff9c5c674a1b964eeae076c32b8ed6f2894574ba9445c1d90b7e76536d9bd68db0406105e217a2c
TLSH
T18CC04C0252C6CE1D1585501B59B562AC80A7AD092A553F108758845E124240DAB82305
MD5 SHA1 SHA512 TLSH

Submit Download

fblo45p2.dll

Path C:\Users\Admin\AppData\Local\Temp\fblo45p2.dll
Size 396KB
SHA256 16a5e92ba0cdf0342ee950f602e903149e6939bf8c112e6c2020307cc22057f2
MD5 43e20753ef9ab73d3e9bd6d48a6b977b
SHA1 74db72d9dc735a902c3c52b6287162fd5e458574
SHA512 eb71d4ab26d481198a6405e860d379f4763ba52450f754a9ea3f8dd0908331886cf3d7155b0bde3a3e96df25692983b8f562c45135e3f5ef9ff4acaeb6cce947
SSDEEP 12288:QAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:3g+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1FA84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g7zlxoe-.dll

Path C:\Users\Admin\AppData\Local\Temp\g7zlxoe-.dll
Size 396KB
SHA256 19677f370da2755b300d9c602d2ecf68e9269e6464a8067d8e724039dd9f69ac
MD5 4c7464c3cddfc3f0ea4c6d7459efa87a
SHA1 5dc15819bb9cdef8d55d57c10413d2b3b0114016
SHA512 e9ea49e6bd4e6d566b6c82b64cf1c60575fb102f8561289e7b765531ddcb45f018058278715353b94c309a16f4836a144cb33d08a9f2cece6d34aea61b452b92
SSDEEP 12288:9Ag6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Kg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1A284482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gf4j5l1z.dll

Path C:\Users\Admin\AppData\Local\Temp\gf4j5l1z.dll
Size 396KB
SHA256 89ea884462943f04bbce0a0e5cf35438f990f8cd1d9fbcda5111d2a764e3629d
MD5 1e988203d87f72e15351701a03c45233
SHA1 d8ebbc4cab9f89831fca7c259e7fb988ca560448
SHA512 13e17b021514a93b5262c0ed4d2973cb78f75a318a58523dfae8aa6839bf7805fd171b96ab988de981efaee5292ab2dfdc8f07982799adca687b703b2821e01e
SSDEEP 12288:EAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Dg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T10984482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gfqetd-c.dll

Path C:\Users\Admin\AppData\Local\Temp\gfqetd-c.dll
Size 396KB
SHA256 d625e6fd990d32e1aa01d4cd1789dfcab0cb651cbc33d89187f54aec14813d72
MD5 9a1cd70252603729c34e03ca6a52b678
SHA1 48cfa3d4ff4bd97c05f7d39d7a47567796884fe0
SHA512 2c8d3c30eebc894725a7064b1132355929d4ec291fddce92672c43cebaaa8c5f0095dabd77cee4b2283ad606fb710620c6b228860b1fb116deffa21a41c75e8a
SSDEEP 12288:YAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Pg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1D984482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmkz0q3j.dll

Path C:\Users\Admin\AppData\Local\Temp\gmkz0q3j.dll
Size 396KB
SHA256 87566ad449b53d7bc3bddccb7159ce388cab10281ee66311d250baed35af1bfd
MD5 979a1017241dcff45d9275783408fc49
SHA1 aaf17c88670f4e0e4f4cba91f0703790f82cbbb7
SHA512 452ffd0037e5e4ba26c6a7878abebbdd875640ff6b597af1103c79547b87d85c199949e8aec91d6c17d7d8bb20068264bcf1fc10774ccf9296b245f094ac7d34
SSDEEP 12288:NAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:6g+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1FE84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gxogh-xy.dll

Path C:\Users\Admin\AppData\Local\Temp\gxogh-xy.dll
Size 396KB
SHA256 419287a2572189f53dd03887c213dbae6490c37f112da3b1eb1d3a1f9c87ae2a
MD5 fd121822419200b22c9ecf3bf287fa83
SHA1 4676abf499995de09966db632c1372d467128958
SHA512 59e20f7e1f930995ac8d77d2859d64efb6d0b403e43e630efda1a7786ad3378213af1fc62060757c67f8261be7bbddd3642f882787eece59e50fff168ed400eb
SSDEEP 12288:yAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Vg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T14984482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

in6lenhi.dll

Path C:\Users\Admin\AppData\Local\Temp\in6lenhi.dll
Size 396KB
SHA256 c3a27a33721c43c8db856c3c3db33347498a5289a4c16190dbf102d40bb4832c
MD5 855c07536941d251f52e565aa0b84c4e
SHA1 859a979877591cfef5bc29da3210fedb7d606530
SHA512 cfc15907511943bd5d70017ec4efc7550d2ced1bdec6eadf19570133bce5bab7bd72158110266800559d11e89542606062d41f4405a99a73394e3672b82098aa
SSDEEP 12288:kAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:jg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1CC84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ixxvdsrk.cmdline

Path C:\Users\Admin\AppData\Local\Temp\ixxvdsrk.cmdline
Size 138B
SHA256 47a611e2cdef6c3561d80d277b7492bd471a0bf84c582a4748a82db885fe6566
MD5 b2f4bf225b83b96f332398c1c7a2efa6
SHA1 0980ad8c5ed1bd0292b6e24155b7ed52d80bd665
SHA512 bf7e2f3155f8339e965ad8e27a4655f194d05cfb49c14946aafb2228d07a2f1530ee818dc36c9b12c7c45a5d21687c59b4a774b468c74c80201d0891b2be811f
TLSH
T156C09B054687CA3915C5D01B77F571DC86B75D1D3E453F104E51C45D1243419B792311
MD5 SHA1 SHA512 TLSH

Submit Download

ixxvdsrk.dll

Path C:\Users\Admin\AppData\Local\Temp\ixxvdsrk.dll
Size 396KB
SHA256 ee1b1d8fa9dd62a1f5d2e2d0f33fbcd9e2c8027b5bc58fdb7444406937ec3a5d
MD5 a284f619329dd2359e04bf1e1a22eff3
SHA1 a151e52ba7a857baccde27fba7e0dd658a251bc3
SHA512 4c982a449026770691d831b6b9ed642e7a9b77c7433ab1c9b153c826a3afeb8369e7288250a8dffe910b1a1fb58a2ceb4ad55dacf0b036510d09b1ccd4bf187d
SSDEEP 12288:eAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Jg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T10E84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

j15gitml.dll

Path C:\Users\Admin\AppData\Local\Temp\j15gitml.dll
Size 396KB
SHA256 e225b3b7bd2fe10183e4b0795e68fcdb415461805778c820adb5963951785bdd
MD5 bfa5d6e225e405338641de9d19719295
SHA1 5268520197e2676ea55f5c218e134ff4867f421a
SHA512 adbdcfb7ab89ab5d95154a7808e4dd514c36660d55e2055ca03ccb28e339f4c8995f0bd34cefaedd7e7b01d58768cbd251852fecb16bb0ab3aceab2065c11abe
SSDEEP 12288:nAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Ag+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T12784482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

j1tfqmcr.dll

Path C:\Users\Admin\AppData\Local\Temp\j1tfqmcr.dll
Size 396KB
SHA256 54271fa3770c8fd1952a542399d0d700fbf2a296e079f0e53f62f262c689f57b
MD5 fb970e9e5001ab2749e7a1e1266df38e
SHA1 8f700d5220f9903aec3f020bd44b77bef02a206e
SHA512 ff6e6304e76d72c3454426bee2d88694ec856f2a42e8a290a1c6e354edcc62ec4367abdc216520de31a4e1d7d68eba300ea78c25c88ab3a9680441d11ae97775
SSDEEP 12288:hAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Gg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T10684482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdfrcld4.dll

Path C:\Users\Admin\AppData\Local\Temp\jdfrcld4.dll
Size 396KB
SHA256 85206e293ddfd76be24e89c4d4e09c1808faebc110b8a159867a9af92580b434
MD5 fa836fc04b5edd1032e21038f884a284
SHA1 253dbbbe839ec80280519f8dabc4e919a7827a7e
SHA512 a4521401d78e358758707f30d54a955e7571d4d4cd433408f4c42870e4297880da11f3922cff36f983cc42c935686afe3318088d2e4644cb7fbc91393f39ab49
SSDEEP 12288:GAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Bg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1AD84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jembzlqx.dll

Path C:\Users\Admin\AppData\Local\Temp\jembzlqx.dll
Size 396KB
SHA256 f9c719c0447fc451617a785b265d2184df5cf974ff2d258a053def61b142697a
MD5 2693b45dd6034a0febccc47b87a170aa
SHA1 000660ac2711a71ddf020117955c8df7b61549c0
SHA512 568d7f55fcae863be79be786b18e88de8eecec99aacbd7d79d273f7e35ffa282230e6b0a09e34297e1359da13bccb629ae5cf7260c9bc5b7df97eb49c2696369
SSDEEP 12288:7Ag6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Mg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T11084482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jy1xjq0_.cmdline

Path C:\Users\Admin\AppData\Local\Temp\jy1xjq0_.cmdline
Size 138B
SHA256 523f62a666d49ac7febf30f5c47c24a64f021ef57f46af83e09ff0a3223ca05c
MD5 1e228468ab30d01b020540282e5c9ef6
SHA1 3f14d88e69f2b5129a5cbe65ed59d70a3a8bd82e
SHA512 5ed90810b030b87bf89698e9787bc375c3c068f155da1e784d87c26127589e5d107aef57fd10a24036489aa1b993fb90ad4084742a20af542908d18834ca5596
TLSH
T13CC09B2257D7C61D1DC5505B9DF5559CC0B36D193E4D3F144A90E4ED124340AF786301
MD5 SHA1 SHA512 TLSH

Submit Download

jy1xjq0_.dll

Path C:\Users\Admin\AppData\Local\Temp\jy1xjq0_.dll
Size 396KB
SHA256 f18f1dad8be4d42dae16b5e7f4d1456b6438fb697dfc91ba8b9f63346f24b441
MD5 907b636355af5020d37e0dcc8c1f43b3
SHA1 29ad301fc75d53849dc7a5ec777b1c33a13fce40
SHA512 be058ef6089dc3deb70f609152b8b50af8c1914d5dfc7e611d442425f588a67eaab30fdb9cb437951d764b70ae760e6ef8818a932754ef00f77201e0147aad6e
SSDEEP 12288:vAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Yg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1E984482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcbaqmr_.dll

Path C:\Users\Admin\AppData\Local\Temp\kcbaqmr_.dll
Size 396KB
SHA256 c8e24434204e05a349e03005803ec2fb383628285923bd4d769ec51bce077e46
MD5 ed02be0c5c76659696994830c2c92338
SHA1 ad74186163be9dea4950acd8eecb2e405e25d72e
SHA512 4bdfd09acb7666ca92763a6c28e6e68feb5ee83f6e2935b47d123a626b5bbfa32356951a5dccd5f85b197050164fbd7ca1739c8f10286f6e63a338a24922f98e
SSDEEP 12288:tAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:ag+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1EE84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kqpcwdfu.dll

Path C:\Users\Admin\AppData\Local\Temp\kqpcwdfu.dll
Size 396KB
SHA256 cfed44a05a784d0082980e99cc278346c6fa2d1a8eff0845e26cdc8bbfaec3ff
MD5 e0796c1d49a8ff20544adbbeeea01fa2
SHA1 ccfc4668e1adc198f1e48c1710ce0e79c4527087
SHA512 7857bb7779c9e34996b39af6965465ff5fe7a4ff7d62b22c6bce34a43f154ba26dd73742ebc8ef0254551de7819a74622ccfdacb8643c8299355be9464b62980
SSDEEP 12288:xAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:2g+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T18184482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kry-c0p_.dll

Path C:\Users\Admin\AppData\Local\Temp\kry-c0p_.dll
Size 396KB
SHA256 98d8312002e7a09360821dab1f257db51611db1b86d64d54da5ae1a6ad517203
MD5 b68ce602de7f9604f8fab2dba4ae8492
SHA1 b648cc5d1bc1878a22eb79d20b9dc6508f88132e
SHA512 fbe312812cd8b8e62911f22884d64171abc912fee97078d48ad41384a70b859f742373cc18b8117b675e0640fb3f67b2754d3303cd09e0b32a4a09989e2c5f47
SSDEEP 12288:hAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Gg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T10084482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktpjv_ga.dll

Path C:\Users\Admin\AppData\Local\Temp\ktpjv_ga.dll
Size 396KB
SHA256 0440d63e2def6df6e90104fdf0f508ce705681d507b63dbf5275ce282e8c13bb
MD5 3c6772c6046210e2cbcccea35417f8cf
SHA1 8791a4ccfe71baa13e7b49077d4a61393cc576e5
SHA512 3127e75c08d46b5dc301249985680d883cc409f90402bfe6ceb57261b63f029466a2cf76ef2dc5dadf578afa29d247c258e1d14d8becf6c5b7cfb815fce67d42
SSDEEP 12288:pAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVds:eg+b6FEb/7sU9dNo1wMOwtzWcRSc/FaP
TLSH
T12C84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

l96q5jxx.dll

Path C:\Users\Admin\AppData\Local\Temp\l96q5jxx.dll
Size 396KB
SHA256 0c8dbbc9af655e22ffe7b2ebb1b86cd6d805654ef316bc2f66fd1b0cd298ef26
MD5 6fab659111fa365eff824c9de1e30daf
SHA1 5adc8297b2c3ae036538f75df603c55abe663211
SHA512 1e0609d47b13cb4b8def30f649c90c3812f7c84ef2c7b25d6df9569374c6e595ab8a48e0574fe03600916931aa293ba7a734c0261a045a09f4c892648da1cd1b
SSDEEP 12288:GAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Bg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1A184482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mj874q86.0.vb

Path C:\Users\Admin\AppData\Local\Temp\mj874q86.0.vb
Size 193KB
SHA256 c27327c84269c2aea729d4fe9e3d302b2e6f5047c5c7f476cfdf5d790a27d933
MD5 6a1cf9b505334f594248958648de000e
SHA1 53bb5e9cf7e51e9c6ac6627e0eebf05250117221
SHA512 e758c39de2990f5e693db9c7cdfcde5573d6ec2e3435f5139b649ec0a07ad01487c2397f4f69726710c7dce900593cba8245d3582e996546aabd4f19d85d6c99
SSDEEP 3072:C27UAbUfBi90X82j5YRWCK6hNn/VcrjmApfQ1XHH1xfUeeIXIFzvEdFTr+BBd:UwZ90rmN/V26ApfQNbseeIXIFzvg+BBd
TLSH
T10F14BF3EE617BD491AFC5D5CA80429C54E0022A3C2B4DB94FE8CE67937CA711DA6C5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mj874q86.cmdline

Path C:\Users\Admin\AppData\Local\Temp\mj874q86.cmdline
Size 138B
SHA256 1a20a42a80224f50c4e38b030d21563b75bc5b73c0b95d30fadf71f9315dff87
MD5 7ac388aef038a0765720d7e9a020a29d
SHA1 60fb357cc53e9763d3a21c2816b1873153da832b
SHA512 b052cdb8e288b271fd18917a6dd0cde61b249ec1caeedcfe895fa37e23b3eded04f32749b034d36e09a6a31051af3fed174949811682d54e976bc0e86051c6ad
TLSH
T1A1C09B028297C6191DD9545FDDFD559C80F35D097E557F5C8650C46D1243449B782311
MD5 SHA1 SHA512 TLSH

Submit Download

mj874q86.dll

Path C:\Users\Admin\AppData\Local\Temp\mj874q86.dll
Size 396KB
SHA256 e36fa002d081f429e637ef731644517cc932f1e34773f9193c805841538f1f6e
MD5 7d9b19f36579687710b86726eac1ca5c
SHA1 1c010e75b374f64e807bb2677b55a063b016dd97
SHA512 5a166d9c02c35cd2e50d23cd670498e32e291a71e7d2ba637f44aee3e95409644de8ccd5690d51e4ce46e88ca7c2915a4f6a642a1a6ad47f7503a39d2b18131d
SSDEEP 12288:jAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Eg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1EF84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mtwjsbzh.dll

Path C:\Users\Admin\AppData\Local\Temp\mtwjsbzh.dll
Size 396KB
SHA256 fa3acfb5214463b49383409cfbdc5109d091c985120ed4d0e7bd1d0eae99b05b
MD5 eea9ccacf0a5726162e382ec893697a7
SHA1 3579484ea3dd84b1a518922d0bed68b9abab3c2a
SHA512 a758d97c4ef699cbc260dc8606a2391a98e722bd277d026e91192452ff4cac48d0f3ebeefcf1c73d5b15b92a6548f15efec03f05a22e00ab34799d70f4400702
SSDEEP 12288:mAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:hg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T12F84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mw-rsb8z.dll

Path C:\Users\Admin\AppData\Local\Temp\mw-rsb8z.dll
Size 396KB
SHA256 36363a1ca2e4d31f1dea407ad2b80d986edcd2cf49010bd975c1ae5025c73282
MD5 c1c573d4f0a25ee288348202a23571c3
SHA1 3b0307ca559d71cf69cd2451076078b8e75aad75
SHA512 7dd97baf685effc8e91a5f550451024c364f9f6102f4189e7e11ca6c05a63c82fe619d7e5fb8dd3e096b19eaa98a06f0dcee2a508819211064500ff89b9c4a8f
SSDEEP 12288:GAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Bg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T11984482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mymotciy.dll

Path C:\Users\Admin\AppData\Local\Temp\mymotciy.dll
Size 396KB
SHA256 399370a9c2751e467dd13152a12023324fe19d488a4aa7cf39d2d9e00429e6b8
MD5 02412c13750dbb8e14859f7086e47266
SHA1 ed06a5e5212217e14557202e2315ad3743ba5d21
SHA512 cea6fd303684b4e905196f0cdc8491811434d50150fc06be59c1e90af7f1c06650164e89e2aa5fa9b78845f70c1dbe8569f2ed259bb4a41cdfbf6cc676daf9be
SSDEEP 12288:xAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:2g+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1A984482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nnsk9blp.dll

Path C:\Users\Admin\AppData\Local\Temp\nnsk9blp.dll
Size 396KB
SHA256 a20b0f37afd8957db4a2705246c5ede466d4ac2e139925ebb60814a31d140f43
MD5 c9f16d4bd240747cc715e44d2045e383
SHA1 4f0d8500beeea1abb1c2fbad12b438828924f930
SHA512 74387600f02d2b84dabde5f22c12be8d98df334f3c8719c91ab88056f8056e90ceead42f1ab329791b07d5f6f6740f73ad461fd0152c3b8f0c48ad36466ded69
SSDEEP 12288:mAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:hg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1E884482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nqv5expn.dll

Path C:\Users\Admin\AppData\Local\Temp\nqv5expn.dll
Size 396KB
SHA256 c17185254057ff5c2f892078825f363ca4b819ae4d2f9dcd25b6c45256ef10ce
MD5 6df6b7d4193d5a1c5de51b693e2b55f5
SHA1 3f5cf8f1051cd53becdcd296685868f52e008c8d
SHA512 adc96e4a1138cebbd983150a4ea264a00135482618f0c6a6353c0dde315c2682d5cbc2d89907861648af29193e90f980d4c95db06be114beb831f5de7962e067
SSDEEP 12288:1Ag6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:yg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1D984482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omairzak.dll

Path C:\Users\Admin\AppData\Local\Temp\omairzak.dll
Size 396KB
SHA256 235ac2f501bf987284be5730fda30350de7bc76ebdbf8fc29cbffcf0f62ff3f9
MD5 aae7b371a4ea5ee13de38632cbd3e685
SHA1 87af9f75dc17b7f440ca60e2a874366fd23b324c
SHA512 1d42f55650fc5e5cd9009b4bda05490d712cbb63296fc366fe680b52c1de645168f4ed61d30b165ec695dcadcb66542a414bfd269e90f879d492298ccc261768
SSDEEP 12288:4Ag6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:vg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1DE84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plcr1-kp.dll

Path C:\Users\Admin\AppData\Local\Temp\plcr1-kp.dll
Size 396KB
SHA256 c476c0cc7e2d23e656112a31f53397d42342f90a3f0db2b68c2b4edd96761005
MD5 a817b6aeb5045d902a6110ec07c036db
SHA1 95d9b40d92314e96eb761649b5f2ad64a98030b9
SHA512 1edb0f7c6ba21a8aaca9a1f867a2866e0e0bd21c4257aa55d02bbcc3c3b76732745020a2ca91869b8a86f8657b94bd92141bff3a03369ad8ba222858b5a88c13
SSDEEP 12288:cAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Lg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1FE84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxkrs30l.dll

Path C:\Users\Admin\AppData\Local\Temp\pxkrs30l.dll
Size 396KB
SHA256 606b565897ca909f5b4413fded2fe9ee25e0f77c16bb53f35091bd1bd49316e5
MD5 e011fa8f8494684a13745d9908813d40
SHA1 ff30d3090556357523db8cc35c17da6436f08541
SHA512 609ed65bb366ceaa50f0a8f05d71aeb4c0e88bc4ac2298ba2e56aba277005e59dfa6e16d7f74d15b51044da7a60d8d03b6bf4183661420c7efec55baac1067a5
SSDEEP 12288:bAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:sg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1FE84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

q4bgd9yj.dll

Path C:\Users\Admin\AppData\Local\Temp\q4bgd9yj.dll
Size 396KB
SHA256 82774cfa157d9ea465b5bf7d57296e17f2517f4236674806df9013f8b3b54cc5
MD5 db5cbea52d86043a02a69487de54176b
SHA1 5c7ec0521f1770b287295abbb25e718240599124
SHA512 b2120cfc8f342f6681b005e984f2d6cd16f3950f56a3755ba4514ba05652b369c0698873d92a820fab86107675944666535ffc37c5a3901be91aa8b19a186e3e
SSDEEP 12288:tAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:ag+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T15284482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

q5dk4wye.cmdline

Path C:\Users\Admin\AppData\Local\Temp\q5dk4wye.cmdline
Size 138B
SHA256 586e3c2cd711f70680831a7bd8a3212705ca6ce3e5e448f9a6f4167be0f40af6
MD5 f5f6db2e696609b6304c977085d59490
SHA1 15b720b7f34c71492a3c2053b0c7ca33bef4ce0a
SHA512 f925f2c092712b1cb4fc540a8d482d775beef8592b77e283a5e6e4810b32524647b78c942564b1646dd8a1460fe116273990ac975211e8f560ff6c89973409a9
TLSH
T141C09B1542CBC61916C5615B55F5729C80B55D093E473F1056A0C45F12C380AB687302
MD5 SHA1 SHA512 TLSH

Submit Download

q5dk4wye.dll

Path C:\Users\Admin\AppData\Local\Temp\q5dk4wye.dll
Size 396KB
SHA256 4431c013611fe9d90bf9d5faf89a8d8d0a6cda3f241452ec0ec18ec35c45cef0
MD5 15d03408db8a395fc6ade6cdffc04b01
SHA1 8115eaf6805dbf454f3ed701af5c9f3259baac30
SHA512 3aa6fae3c30cccdcd2fdf260b813f2007381a363a73d035aa2c077423940ae1b26e90921373298ff51b90aba8b074a650a2b0ca9bf010678d353200f1e9bf177
SSDEEP 12288:zAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:0g+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1DB84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r0tpstbe.dll

Path C:\Users\Admin\AppData\Local\Temp\r0tpstbe.dll
Size 396KB
SHA256 b1e696d6511ab8d4c003ffbc79999379b2460ad5d9193ad7a5835d1a47fae537
MD5 63e95d1a98bac8f33656f2b924025e38
SHA1 c5aa43dd635c14849adf84e59dfc7abdc2a1e81b
SHA512 59a11ffa70d847946656bc8524b192c0cff7658a0f55bfd298cea49f06408819894f6772c924ab0f2d89ebe472290bbcbe15a38f1a92399173a2216351a6f57c
SSDEEP 12288:KAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:dg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T11284482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpx3mle6.dll

Path C:\Users\Admin\AppData\Local\Temp\rpx3mle6.dll
Size 396KB
SHA256 9a905fef77994bb44f926f4b4caf479d125751dedb76216dc9471aa90420b91f
MD5 262fdaec61da0ce32f3332c779d5e921
SHA1 bad82e97dec1dc39103db26ef7e8afe39154a2f2
SHA512 3617359410a29594032b63ed155cd5a71a6a1a4c2bab9632ca8a9ef3a34db03319f355ae032e50424fd6bd5ba02cf7e75eb560228b8119030fb2fa1afc504886
SSDEEP 12288:yAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Vg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T10E84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s_gsdkts.dll

Path C:\Users\Admin\AppData\Local\Temp\s_gsdkts.dll
Size 396KB
SHA256 7ad2378f7263619556f7a8d5781dee44c198c12cd7f677f973ac310779e389b0
MD5 df4a1af5d1a51e75c83b31be3aff0446
SHA1 5d93f04f4c6c1a7b966727094067c73826070941
SHA512 ece11ccc3a2a667400f211a60a42654f5c891d7c6e4d34611dd94b18792d74204f4eb4d858d4f51746d13fb1cece5b11b7af147435ecb47ff122f8898c8c7be1
SSDEEP 12288:GAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Bg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1CD84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sb2aumpr.dll

Path C:\Users\Admin\AppData\Local\Temp\sb2aumpr.dll
Size 396KB
SHA256 0abda31c9ea12446ba2d797b2ae14c956edf982cd2070c30d34fdb8c738b3eb5
MD5 09ba9bcf2c58869d2a82f4ae3bbdc98c
SHA1 3fa6d76f8d4216cbd4933f58ad32f98914ca1c18
SHA512 cc35766665277cb62f5980b813adda0e37f2ed699ef2f3402c749b93fac86f53b1baf15b2f6b2477932004312f2cf2007cda7ee3daee806217d1618f03e2d18e
SSDEEP 12288:lAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Cg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1E884482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sbd1mzs2.dll

Path C:\Users\Admin\AppData\Local\Temp\sbd1mzs2.dll
Size 396KB
SHA256 3559d5b4847ce81bd9531a81fdd4b1fd51297cb66bc2e6c5c50e2adfa38eff6b
MD5 eeca8890d8c49ccaca32d0c8c74ed3df
SHA1 9f9478bea1158b0d6acba583fd4a4898cbb28750
SHA512 2a2504d87e6f02475a39471e3439d82d5cff73811bf5e2196c5297b60e850760776a952fbb6a1ba1b0aedd481eb37fb49da14be321cba97ef355056477286ede
SSDEEP 12288:CAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Fg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T18484482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sxftcoor.dll

Path C:\Users\Admin\AppData\Local\Temp\sxftcoor.dll
Size 396KB
SHA256 0931f157f6ba861db04ce89b261ee21b7da82beceaeb6c635da13f395f9f22fa
MD5 0852f619db2dab9d491ecf77710628fb
SHA1 f367553f0856022cf45272e364915b33908dce12
SHA512 8fb8b891e1ceb5f1d76b39af1c5fdb3e40a09ff24b72e05166ed49d7908034759482df138c3847b64f5c56064aafaeed363593840609858470eb8a9afe9a46e0
SSDEEP 12288:xAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:2g+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T12584482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sy1zk7cw.dll

Path C:\Users\Admin\AppData\Local\Temp\sy1zk7cw.dll
Size 396KB
SHA256 7456fdc2a7c770e3dfa85113d146eadfa4664bd38f1e9f908ea73a419fecc1d7
MD5 6e892246a35ae499b328ad28df944d92
SHA1 42d01e1b0d0bba60ac224d1f1916b5093d3c8371
SHA512 6ec52de28cc4ec62964c37a6b5553e3ef0cbd4a4d3a665ff7c303c68e2808209bed0c83b782a99155b945414e1b80c61ff6bf5da2a952595914434285edb58ff
SSDEEP 12288:UAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:zg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1D484482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t3k76p5m.dll

Path C:\Users\Admin\AppData\Local\Temp\t3k76p5m.dll
Size 396KB
SHA256 bf978d7ed5bc6e5900a5216d18bfcfc304af86805b73ad997915a9f8a2a1d50d
MD5 f9ab38d5328bf6806af865b0a076478f
SHA1 5913afa861ed106a45d8f409d88cc2b37e2371c7
SHA512 7ad919ef9cc8bb585e742da1bba915f9a9a4bcda0b24b79f23d4f39729d3a9bb809106e2023e1471d44d838f070cfbaf7003601e57c1791f92962104b3cc7d5a
SSDEEP 12288:RAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Wg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T18884482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tg2uv_ys.dll

Path C:\Users\Admin\AppData\Local\Temp\tg2uv_ys.dll
Size 396KB
SHA256 0d8207144c9fe5d62114d5e751e52fcbe4099b26e440f599dac688691f7c1a86
MD5 16085ff45f68df79b77f3dff96e656de
SHA1 826ac02f3975be5d4c048694d5aa58ed6f6a7113
SHA512 989539026932234d23445dfd937747ca3cf4a5214e2ecdce95d47b50f67421ce3a58b7bf090bee77cacaae6ae63cfeaaf5bf581aa467f9684ab4c0ab49dce143
SSDEEP 12288:eAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Jg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T19984482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tl4zgxf2.dll

Path C:\Users\Admin\AppData\Local\Temp\tl4zgxf2.dll
Size 396KB
SHA256 2ac442acffb52aec2bca0db8234173adc76ce7162d0dd63cf4223e8d1a47b69d
MD5 80c8dbf833022b609216cd84ccf905fc
SHA1 a3cf1db692bad7d1b8fc96e6f13780a0a0b4319e
SHA512 0dfbbd53e7da2e2c18573765669b2e4d900604b11857e6d0d23a0a69b2d0b1bca304671fc24d983509c0d0937fa45c30929b715c7d932510854ee8baf0eee0f2
SSDEEP 12288:YAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Pg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T10684482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

u9y1qq5d.dll

Path C:\Users\Admin\AppData\Local\Temp\u9y1qq5d.dll
Size 396KB
SHA256 8b34664b017a400ba9327913bcc3183b3e30a5e65fe91bb3bf75d6bd868f761c
MD5 28b6b636cd245baacd8be4825a96cfff
SHA1 da5da9ff4cee6ea129ad7c8380fcacc214d060e3
SHA512 0ff3cf0c248bb75f6beabb096f0952e38c386df2d6f6427e7cc55306077698da258e2cf6dd710874719b0fbbb9179fa1910e021f512b9922bc171e3f77fdf0b4
SSDEEP 12288:dAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:qg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1D184482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v_ng7mcp.dll

Path C:\Users\Admin\AppData\Local\Temp\v_ng7mcp.dll
Size 396KB
SHA256 d54bb2436fba5229da0a72c20ba9020bfa7e3ced54542b3eb255a51de5422a9a
MD5 1b3c1fcdffa8d927eb8a63623660ab02
SHA1 684e5f141d9473d7532fd1ba3610c638a045fa0e
SHA512 4b75e68dbb772089b630015bf8cd783b763533393aa3ef0eecbc8e225dd09ce6b74c76c58b39ad03ef9ce2691ba03db887c4b76db2215e925e37a39aa4a54356
SSDEEP 12288:dAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:qg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T17784482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vakdoezk.dll

Path C:\Users\Admin\AppData\Local\Temp\vakdoezk.dll
Size 396KB
SHA256 1cb7ca9fe8141a3e6beb97c6f92ca88f097f9a6ffc3360f9a05124697fdd9450
MD5 1be295194152872486955f299548df61
SHA1 bd6c37e34952870bf904d57c12ccccda157a62f6
SHA512 62431d208a1e78e0da6684fadfd3dfd3ede523cdc2796ef6ef20f30aaebd84f90b21cabd4e356ded6c7946bbc970e2d2958b04ec58cef7f909d13afa79a8ae20
SSDEEP 12288:iAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:lg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1B584482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbc4B0D82EF82248CDB14AB1A897633E45.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc4B0D82EF82248CDB14AB1A897633E45.TMP
Size 652B
SHA256 5c089f6b0cb4a560be365f73aebe3f7d5e86ef448a725972e29e04123ca1f753
MD5 7340de2d537208fe17e6c12c8c5de6bb
SHA1 564e9a811b9fd53f45ce6ad8c9cf95a3a3cd5374
SHA512 a9aef5234e34201626e9cfdb0ab82608bd9f6a3d27647c44084d10f5e0aa66eb4ff2f40718069ccb77b56413302bcf43031f55755d57477295503b29ea788f6a
TLSH
T18DF05E0A63F8021EF0F35B70BDF64367D1A8BC64DE3293ED5441131D2C646208A62FB6
MD5 SHA1 SHA512 TLSH

Submit Download

vbc57698ADCBB0740889C5E89D0991FEEB0.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc57698ADCBB0740889C5E89D0991FEEB0.TMP
Size 652B
SHA256 aa3c5f19062af5fb1b03a0fe6fcfc912ee4d73589a85c0c6efcd74ffc6ea3c1e
MD5 8dae98f6e18a88ff08e0c95993b74064
SHA1 9228164643a66e557feee1bb6eeb9cfe9eefa66f
SHA512 798eddedc520271d39b5b6fe4cb0178fed1c992ce0b6c05ab9ba580100bb622eca24040215ffba1f87cd5faec8990ecc927774c5479fb3e04e2796021fbafe6d
TLSH
T1CBF03A0963FC420AF4F35B31B9F6436391A9BC65DE7293ED185043192864910C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc5809B29383004900829C7BF9408787E.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc5809B29383004900829C7BF9408787E.TMP
Size 652B
SHA256 d44d0a1c9d480f6c2424fc902e7a5563dd28312a48ef628da8ef78379dd4161c
MD5 a702e8358f2c1cb298130cbdeada3af4
SHA1 2f0aff9d107a7d483a9ef360360a1b8cc18b9682
SHA512 6f28b039c8fd62de253037e5289c107f121376f7491adaf68429a5a5f1c2aa777ab5756ca2d81cc19f0c90b2de44b31438383ac12e90a4d0b7dddd2f842a3604
TLSH
T10FF03A4967F9420AF0F34B30B9F643A391A8BC64DE3293ED1440031D2C75610DA62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc6171CF2294D2478683B2E6D615E998C.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc6171CF2294D2478683B2E6D615E998C.TMP
Size 652B
SHA256 8676f2366c35ecebba589f5c1a56f107d2657fc69cfa82496d32f36aec9de9f5
MD5 51f608e6df4f3bdfc7a71e194bf45cd7
SHA1 f65f2b05cc9b31c4adb55faa4e472c19e6003dc3
SHA512 005d2d4730aea26f3cac53bf932c69ebe3bba208720240fb192bc96c3de41719b15f13fbfafc8e23e24c4cdb5c29cb859c6d95dc3ce9e21bf152b7d3b3efdd28
TLSH
T18DF05E0967F8020EF0F34B30BDF6436395A8BC64DE3293ED145403192C65A208972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc627A5A99B24D433D8AB8BBC454287252.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc627A5A99B24D433D8AB8BBC454287252.TMP
Size 652B
SHA256 603d5b6ab9a72baab235e5cbf67e6d9bcf47e4c850eb4cb1163a46440bf5a68b
MD5 7895d7d65cea2e20aeb6d4283b197616
SHA1 c51a8b3b814d6bbf40ad8314a296c6d431e98f06
SHA512 66c3bc3a5c470a676c8f07a6ddd547e72c1cd10e9587c58a089c09aac8ac742f5a4dd8eee8b5107f7d6c6dc784a7e584c207664b96fd5d9018c367fa22214381
TLSH
T186F05E0967F8420EF0F74B31BDF6436395A8BCA4DE3293ED548403192C649109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc806FA589BF4349E585A73E90A2F8558F.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc806FA589BF4349E585A73E90A2F8558F.TMP
Size 652B
SHA256 3cecbefba248bc8fa7b8016ff0e37f41c9b665d298f966e802d88faf22488e64
MD5 ee13634b925d2eb6ba547db5af8afc63
SHA1 0427a08b42023a483758273a87f5151e7665f8c2
SHA512 7759535b449042e293900a70bfaaee3ed4a157cff228daf09ad0207831d1f982dde2b326ab48191fe7321fb4f2c3ba55f57049e4cb21098d7d6e7db5a3bfc806
TLSH
T1C4F05E0963F8420EF0F75B70BDF6536391A8BC64DE32A3ED1440035D28645208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc8E83A2667651475C867D1FFBB450811D.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc8E83A2667651475C867D1FFBB450811D.TMP
Size 652B
SHA256 296c001d2fa68d017814697d7daa645ba92e6443d01e10ca15c980e7542f057d
MD5 342a9769a1f839f274d38a988d2fc89e
SHA1 305b832ac5731906f4fd01bfd37b389b39dfef9f
SHA512 71e2af3216e747dd75379e31e3a8b60c2430cc135e52ea7607bae6a550e41286f52fa149ae3c5c72ce5d4348431bf6d7cbda5a0db99ee7833ac6fd78146cb30d
TLSH
T1DEF05E09A3F8020EF0F34B30BDF6436391A8FC64DE3293ED144003592C656208972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc92109D14680F48849558292A244A579F.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc92109D14680F48849558292A244A579F.TMP
Size 652B
SHA256 4ac62d161c5ec37e4e3222dbfe90efe28383c0831eec7b10c22a708202a804ef
MD5 38d3ba153fae9dd79f446773103dd770
SHA1 2b4cad8154984abd6c9d2050b65c4ba5a73a1e87
SHA512 0c819bd8ef1e990b0d0e178531307867d1369cf3878bb1722dd66d2ac9a0df740f62de0181614852787de357023cfff3844b0886955cf5d74e611f67db6cc702
TLSH
T1CDF05E0963F8420EF0F38B71BDF6836391A9BC65DE7293ED1440431D28655108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbcA6ACB81E664B4ECB9E511C67C31CAFEE.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcA6ACB81E664B4ECB9E511C67C31CAFEE.TMP
Size 652B
SHA256 b05da5440d5013e2879be984acd69a8443241b0a07a65a4f9d79853da0d653c4
MD5 88caa074a5e53a7b88319f9e70984cd4
SHA1 18fd371c3e5901004ff822edbe60836b1bbfc7d4
SHA512 c4c596b63db4e3976ad771c66e8ac1591a571bf4b025037f070f78da15dc0f37e7a760c36976e536266dc600277b41ec598f0cd559c4e7617dc486b46e401a4f
TLSH
T189F0540963F8420EF0F34B30FDF543A3A168BC64DE3253ED54900319586551089A1F71
MD5 SHA1 SHA512 TLSH

Submit Download

vbcB174EA8A88794E95833F1848953FE7C.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcB174EA8A88794E95833F1848953FE7C.TMP
Size 652B
SHA256 d40e8f35979b4ed62c76f45ad3a9d00359c847a51e45f03ad120afa605b4bec4
MD5 663b5a3d80cecf780d2b5e4541bbdd82
SHA1 e31fe76f11b76121b73a4f95f44193509e33caf3
SHA512 df250974b3faf0981e628615d1e84ea081c74565d1c2a2d2406a1effa534172cdd2ed8a1a4d710d39e7e79754ea82e9ad3b4b7565ed9834c90be5ff2ab2709f8
TLSH
T197F05E4973F8020EF4F34B30BDF653A3D1ACBC65EE3293ED5490031968649209962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbcB3EFF98DE5244E909A146FD5BE1E56C6.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcB3EFF98DE5244E909A146FD5BE1E56C6.TMP
Size 652B
SHA256 6f67a856e2527f89c64163ceec2c5a672fe3ff3a92b3d2efb7d62e5c919e8f99
MD5 45afb7f5a434d784771f8c6617ccb88e
SHA1 88ecccf5b24bcb5aefbdc9d92513e7eeecdea946
SHA512 23176a382c5580b788332894093d763540ccac5b3727cde8f48666753f91683a7fda09aaa23875fa6e10a7393ec6c5b909df4005dcb26cd7196a437900082bbc
TLSH
T195F0300963F8020AF0F34B30BDF543A3A16DFC65EE7293ED158003191C645108561F71
MD5 SHA1 SHA512 TLSH

Submit Download

vbcB7CE5DEE49024933A6A8C24DB9E0676C.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcB7CE5DEE49024933A6A8C24DB9E0676C.TMP
Size 652B
SHA256 9e9d868e429e50fdc890d1b783987efaed3ea2c3890c32e5797c5ffd2f140da4
MD5 67b001f6baaabbf12fa0b71ea7e5918c
SHA1 e65eb63925a24ff7b30f9ea50da1cb8de5d70eed
SHA512 838191062d02fcd382b1e644f6c96ebb18d3064d866f14c0c2fe038ae48d68fb0e91d8c81d8776081ab8a9d4de990c5239d8711039d04fcf042180eab5e5efba
TLSH
T1B0F05E0967F8420EF0F34F31BDF6536391A8BC65DE3293ED144003192CA4A248972FB6
MD5 SHA1 SHA512 TLSH

Submit Download

vbcF47057566B4841FEB2BA0595FEEB6A6.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcF47057566B4841FEB2BA0595FEEB6A6.TMP
Size 652B
SHA256 47d7ffb6c436b6de4e411adec8bca9083e634c4944e5748722dcb519c18f38d6
MD5 da04193788a96768f1ad8019b9b6a2fb
SHA1 f2a3d4962e9417f176208bd5dfa23aadab06ec59
SHA512 6478181670ecff9ef2dd9df85e8e5ba2be55bcafed146e01570ea508a53ad6cfd89a5cb8f5ce1daded858f968c8233cd908a18b43fc1680ec15c78f8bc203a3c
TLSH
T17EF0540963F8020EF0F34B30BDF543A3E178BC65DE72A3ED1480031D28646149661FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vkulel5v.dll

Path C:\Users\Admin\AppData\Local\Temp\vkulel5v.dll
Size 396KB
SHA256 37d00dba98d3e17c111417be343857febd8265159fe6d53ffb88a66fb37f43b2
MD5 397afaa8bddc19448199254c2cb1f065
SHA1 9a211e6a8718067eb96045b0c304916ebdef5e9a
SHA512 a806aade8c1f7b8390e92d969829ad23e6e341beb99d00c20f89ad31db0a1ec76e8cfa5d45f4dae20efbdc550df6a0cf969dbb869967b7faf5e6d268b3081848
SSDEEP 12288:cAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Lg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1B784482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yxazcyey.dll

Path C:\Users\Admin\AppData\Local\Temp\yxazcyey.dll
Size 396KB
SHA256 7a3ec8674c7f45ac0ab23018e620668a433d2f79b8ccb242dab244d8657640a4
MD5 d2f6c4b354750d2c680feb7daf54da69
SHA1 5f2e553505fb5de4179e69410a2dc1a8b937a997
SHA512 06ebeb83bbe8bd5da689f58bbd5404eb0df73d6578912d258403d6c398ce714cffceda221c0a98d4835a5ec20df5c0f9510dabbf5726ed3090b46e1d1633534d
SSDEEP 12288:2Ag6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:Rg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T14484482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ziy3kuyk.dll

Path C:\Users\Admin\AppData\Local\Temp\ziy3kuyk.dll
Size 396KB
SHA256 ed689ec559cadc27884d9937e1acc5f2f04b1cfca2fea9e63a47e5eb5368c88a
MD5 ac432b7843b842b151b77d43a5a6f721
SHA1 c6e87e30aa9c769535fe92483cd22994d724fa5f
SHA512 e320a9fa3e2230adfddf8694dfbfa95714a2f6a59027c58d5e8e94ad1721a9a7b772a8f21b4687d6b35b74008525e0ce11fe2f84c7d29128021c7a31be5e2ad0
SSDEEP 12288:1Ag6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:yg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T18F84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

znyh7rhh.dll

Path C:\Users\Admin\AppData\Local\Temp\znyh7rhh.dll
Size 396KB
SHA256 5e224508be31af54bd8314b1dc7a2e9fee2de61de1eacfa2f4bb7efd765ef1a3
MD5 823d25df50d4c9284c4afe4e860a220d
SHA1 06c4172216876739b84023cbb877164dbfeac88d
SHA512 ed826746eb47026d0a867ebe2b669a020ee70fff2ead0d8bce1b5e9cd5c26c012a5f937a7e4bf22937095773a370c51f9b8d04c455f40649eab4391c6de128d7
SSDEEP 12288:KAg6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:dg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T17E84482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxjfuhtj.cmdline

Path C:\Users\Admin\AppData\Local\Temp\zxjfuhtj.cmdline
Size 138B
SHA256 d33fd6b2720e30c94bed7015b36baba829f78e39e340a4e874136a0718e95d75
MD5 51ee568a8b212bdbdb73816d0107e962
SHA1 c793d93e7c71231f914f793fb62b2fec1ddf31c0
SHA512 c5ea0eaaaf27387299acc35aa83eb606e5df1ad1d777ac3b3916ebac6084a4535df1a96b1c9f33c782756bb93167b273ca0c8889e0f95f9ec66d27e56a8ac966
TLSH
T102C04C064686C61925A9A15B56A962BC81A15D5A2E853B514654C69D1242409A692202
MD5 SHA1 SHA512 TLSH

Submit Download

zxjfuhtj.dll

Path C:\Users\Admin\AppData\Local\Temp\zxjfuhtj.dll
Size 396KB
SHA256 8319346b2bc7c3cd470e34734c58be6df5efacf15d48bce780825f2af2518a2e
MD5 7180f66dcc4b0eba00d5413f3370eee7
SHA1 78084a49c89e9fb5a7376ab9498ffff37ea2c272
SHA512 73f6cc4573d84913860a9d9dc008449bf3de7a9fc0f2a978ad79d7fbae13d5de4334e831279cfb6c36ba73ce53fa77f10d4da1d4da7e5d63c620d0eecdb08b9e
SSDEEP 12288:8Ag6lbQ35D3Eb/7sU9dNo1wMOwt/zWcRSc/FamwePApkR/jN1QgKdVR42utacVdE:rg+b6FEb/7sU9dNo1wMOwtzWcRSc/Fag
TLSH
T1E684482028FB101DF3B7AA7D9FD4B5AEAA6EB763270A60BA107503474713981CDD1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-614-0x000000001C7E0000-0x000000001C846000-memory.dmp

Download

memory/264-623-0x000000001C8A0000-0x000000001C906000-memory.dmp

Download

memory/484-150-0x000000001C520000-0x000000001C586000-memory.dmp

Download

memory/868-200-0x000000001C6A0000-0x000000001C706000-memory.dmp

Download

memory/1096-299-0x000000001C1A0000-0x000000001C206000-memory.dmp

Download

memory/1148-560-0x000000001C910000-0x000000001C976000-memory.dmp

Download

memory/1180-317-0x000000001C940000-0x000000001C9A6000-memory.dmp

Download

memory/1232-164-0x000000001B990000-0x000000001B9F6000-memory.dmp

Download

memory/1336-353-0x000000001BE80000-0x000000001BEE6000-memory.dmp

Download

memory/1412-470-0x000000001CBA0000-0x000000001CC06000-memory.dmp

Download

memory/1520-785-0x000000001C080000-0x000000001C0E6000-memory.dmp

Download

memory/1552-66-0x000000001C040000-0x000000001C0A6000-memory.dmp

Download

memory/1712-578-0x000000001C8F0000-0x000000001C956000-memory.dmp

Download

memory/1756-479-0x000000001CB80000-0x000000001CBE6000-memory.dmp

Download

memory/1832-122-0x000000001BF20000-0x000000001BF86000-memory.dmp

Download

memory/1892-326-0x000000001BDA0000-0x000000001BE06000-memory.dmp

Download

memory/1904-344-0x000000001C3E0000-0x000000001C446000-memory.dmp

Download

memory/2040-839-0x000000001C360000-0x000000001C3C6000-memory.dmp

Download

memory/2080-542-0x0000000001030000-0x0000000001096000-memory.dmp

Download

memory/2088-108-0x000000001BEF0000-0x000000001BF56000-memory.dmp

Download

memory/2232-461-0x000000001BCD0000-0x000000001BD36000-memory.dmp

Download

memory/2324-659-0x000000001C5C0000-0x000000001C626000-memory.dmp

Download

memory/2328-308-0x000000001B8B0000-0x000000001B916000-memory.dmp

Download

memory/2380-668-0x000000001B8B0000-0x000000001B916000-memory.dmp

Download

memory/2436-740-0x000000001CAD0000-0x000000001CB36000-memory.dmp

Download

memory/2516-641-0x000000001BDC0000-0x000000001BE26000-memory.dmp

Download

memory/2544-605-0x000000001C520000-0x000000001C586000-memory.dmp

Download

memory/2680-80-0x000000001BFC0000-0x000000001C026000-memory.dmp

Download

memory/2724-290-0x000000001BCB0000-0x000000001BD16000-memory.dmp

Download

memory/2752-236-0x000000001CBE0000-0x000000001CC46000-memory.dmp

Download

memory/2828-263-0x000000001BF00000-0x000000001BF66000-memory.dmp

Download

memory/2884-227-0x000000001C8B0000-0x000000001C916000-memory.dmp

Download

memory/2916-362-0x000000001C8A0000-0x000000001C906000-memory.dmp

Download

memory/2932-371-0x000000001BE30000-0x000000001BE96000-memory.dmp

Download

memory/3088-515-0x000000001C170000-0x000000001C1D6000-memory.dmp

Download

memory/3196-36-0x000000001BD10000-0x000000001BD76000-memory.dmp

Download

memory/3196-37-0x00007FFF18640000-0x00007FFF19078000-memory.dmp

Download

memory/3196-25-0x00007FFF18640000-0x00007FFF19078000-memory.dmp

Download

memory/3196-38-0x00007FFF18640000-0x00007FFF19078000-memory.dmp

Download

memory/3216-587-0x000000001C7A0000-0x000000001C806000-memory.dmp

Download

memory/3264-94-0x000000001BDB0000-0x000000001BE16000-memory.dmp

Download

memory/3352-677-0x000000001C3A0000-0x000000001C406000-memory.dmp

Download

memory/3408-650-0x000000001C550000-0x000000001C5B6000-memory.dmp

Download

memory/3448-19-0x000000001CBD0000-0x000000001CC36000-memory.dmp

Download

memory/3448-21-0x00007FFF18640000-0x00007FFF19078000-memory.dmp

Download

memory/3448-0-0x00007FFF1893A000-0x00007FFF1893B000-memory.dmp

Download

memory/3448-8-0x00007FFF18640000-0x00007FFF19078000-memory.dmp

Download

memory/3448-4-0x00007FFF18640000-0x00007FFF19078000-memory.dmp

Download

memory/3448-2-0x00007FFF18640000-0x00007FFF19078000-memory.dmp

Download

memory/3448-20-0x00007FFF18640000-0x00007FFF19078000-memory.dmp

Download

memory/3448-3-0x000000001C4F0000-0x000000001C9BE000-memory.dmp

Download

memory/3448-1-0x000000001BF70000-0x000000001C016000-memory.dmp

Download

memory/3452-704-0x000000001C920000-0x000000001C986000-memory.dmp

Download

memory/3492-272-0x000000001C4E0000-0x000000001C546000-memory.dmp

Download

memory/3564-731-0x000000001CA40000-0x000000001CAA6000-memory.dmp

Download

memory/3832-245-0x000000001BD20000-0x000000001BD86000-memory.dmp

Download

memory/3860-443-0x000000001CAD0000-0x000000001CB36000-memory.dmp

Download

memory/4124-812-0x0000000002890000-0x00000000028F6000-memory.dmp

Download

memory/4152-830-0x000000001CB00000-0x000000001CB66000-memory.dmp

Download

memory/4180-533-0x000000001C9E0000-0x000000001CA46000-memory.dmp

Download

memory/4228-389-0x000000001BF10000-0x000000001BF76000-memory.dmp

Download

memory/4352-281-0x000000001BE60000-0x000000001BEC6000-memory.dmp

Download

memory/4368-398-0x00000000027F0000-0x0000000002856000-memory.dmp

Download

memory/4388-488-0x000000001C9C0000-0x000000001CA26000-memory.dmp

Download

memory/4392-335-0x000000001B2D0000-0x000000001B336000-memory.dmp

Download

memory/4512-524-0x000000001BDC0000-0x000000001BE26000-memory.dmp

Download

memory/4592-506-0x000000001C550000-0x000000001C5B6000-memory.dmp

Download

memory/4748-416-0x000000001CCC0000-0x000000001CD26000-memory.dmp

Download

memory/4792-686-0x000000001C580000-0x000000001C5E6000-memory.dmp

Download

memory/4804-767-0x000000001C600000-0x000000001C666000-memory.dmp

Download

memory/4816-722-0x000000001BF40000-0x000000001BFA6000-memory.dmp

Download

memory/4840-821-0x000000001C1A0000-0x000000001C206000-memory.dmp

Download

memory/4848-713-0x00000000033B0000-0x0000000003416000-memory.dmp

Download

memory/4888-452-0x000000001C190000-0x000000001C1F6000-memory.dmp

Download

memory/4900-136-0x000000001C850000-0x000000001C8B6000-memory.dmp

Download

memory/4936-191-0x000000001C3B0000-0x000000001C416000-memory.dmp

Download

memory/5004-209-0x000000001BFC0000-0x000000001C026000-memory.dmp

Download

memory/5040-425-0x000000001BA60000-0x000000001BAC6000-memory.dmp

Download

memory/5076-254-0x000000001C300000-0x000000001C366000-memory.dmp

Download

memory/5088-380-0x000000001C8F0000-0x000000001C956000-memory.dmp

Download

memory/5164-749-0x000000001BFF0000-0x000000001C056000-memory.dmp

Download

memory/5192-758-0x000000001BD30000-0x000000001BD96000-memory.dmp

Download

memory/5260-695-0x000000001C5B0000-0x000000001C616000-memory.dmp

Download

memory/5332-497-0x000000001BEF0000-0x000000001BF56000-memory.dmp

Download

memory/5344-632-0x000000001CC40000-0x000000001CCA6000-memory.dmp

Download

memory/5368-434-0x000000001BF50000-0x000000001BFB6000-memory.dmp

Download

memory/5436-569-0x000000001CBB0000-0x000000001CC16000-memory.dmp

Download

memory/5468-218-0x000000001BCB0000-0x000000001BD16000-memory.dmp

Download

memory/5488-794-0x000000001BD20000-0x000000001BD86000-memory.dmp

Download

memory/5516-178-0x000000001C8B0000-0x000000001C916000-memory.dmp

Download

memory/5536-803-0x000000001C080000-0x000000001C0E6000-memory.dmp

Download

memory/5712-52-0x000000001C960000-0x000000001C9C6000-memory.dmp

Download

memory/5816-596-0x000000001BE60000-0x000000001BEC6000-memory.dmp

Download

memory/5968-776-0x0000000002660000-0x00000000026C6000-memory.dmp

Download

memory/6092-407-0x000000001C5A0000-0x000000001C606000-memory.dmp

Download

memory/6120-551-0x000000001C980000-0x000000001C9E6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads