Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 07:28
Static task
static1
Behavioral task
behavioral1
Sample
1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe
Resource
win10v2004-20231215-en
General
-
Target
1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe
-
Size
200KB
-
MD5
1c323571263fae709a03a787aa4416aa
-
SHA1
1b4ded050e06e6f69673fe58bca449463dada9d6
-
SHA256
f71df94cb7a60777ee2c105d8f9fa10772ad43a36f9f9d013026704b809c96de
-
SHA512
7fb6dec1950b29c37338712cb19155c3bd7b1ad67497900489dea54d63dc9e89daed4506a89aba2d5503a30040a92b5b64aa4378b7e920f7a055ccbf07ad2efc
-
SSDEEP
3072:r1LipdLEQcDFjVPKvFd4jxHMgcosvFSZjLxMmnWmjEChTBs3/JEZb2SWi:r+LEQyg9OpAF2LxxWWEChTBsBanWi
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (86) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation fckUEYQA.exe -
Executes dropped EXE 2 IoCs
pid Process 5088 jiIAcMcQ.exe 3240 fckUEYQA.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fckUEYQA.exe = "C:\\ProgramData\\KGYwIwgA\\fckUEYQA.exe" 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fckUEYQA.exe = "C:\\ProgramData\\KGYwIwgA\\fckUEYQA.exe" fckUEYQA.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiIAcMcQ.exe = "C:\\Users\\Admin\\TewMUQYc\\jiIAcMcQ.exe" jiIAcMcQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LqcMokAE.exe = "C:\\Users\\Admin\\WgIgcAYE\\LqcMokAE.exe" 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sMUMUgwI.exe = "C:\\ProgramData\\kaoYoMEk\\sMUMUgwI.exe" 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiIAcMcQ.exe = "C:\\Users\\Admin\\TewMUQYc\\jiIAcMcQ.exe" 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe fckUEYQA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2880 220 WerFault.exe 1728 4628 2192 WerFault.exe 1727 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 2784 reg.exe 1240 reg.exe 4376 reg.exe 1536 reg.exe 4628 reg.exe 1964 reg.exe 2484 reg.exe 1564 reg.exe 2052 reg.exe 1068 reg.exe 3720 reg.exe 3756 reg.exe 2868 reg.exe 732 reg.exe 1736 reg.exe 4744 reg.exe 1028 reg.exe 1964 reg.exe 3876 reg.exe 1964 reg.exe 4080 Process not Found 4112 reg.exe 2912 Process not Found 2956 reg.exe 1704 reg.exe 4600 reg.exe 2564 reg.exe 908 reg.exe 2444 reg.exe 4660 reg.exe 3224 reg.exe 5048 Process not Found 2480 reg.exe 2896 reg.exe 3968 reg.exe 4080 reg.exe 4104 reg.exe 4712 reg.exe 3304 reg.exe 5024 reg.exe 3720 reg.exe 2652 reg.exe 2196 reg.exe 4604 reg.exe 3464 reg.exe 2392 reg.exe 2236 reg.exe 444 Process not Found 4984 reg.exe 2316 reg.exe 3024 reg.exe 3612 reg.exe 8 Process not Found 3272 reg.exe 3180 reg.exe 2564 reg.exe 3712 reg.exe 2016 Process not Found 3224 reg.exe 5092 reg.exe 1496 reg.exe 5032 Process not Found 3108 reg.exe 3488 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4188 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4188 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4188 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4188 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1164 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1164 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1164 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1164 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1544 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1544 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1544 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1544 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4312 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4312 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4312 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4312 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 2612 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 2612 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 2612 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 2612 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 3244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 3244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 3244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 3244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4692 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4692 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4692 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4692 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1664 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1664 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1664 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 1664 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4552 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4552 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4552 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4552 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4212 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4212 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4212 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4212 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4660 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4660 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4660 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 4660 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 3824 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 3824 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 3824 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 3824 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 3532 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 3532 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 3532 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 3532 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3240 fckUEYQA.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe 3240 fckUEYQA.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 5088 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 84 PID 2244 wrote to memory of 5088 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 84 PID 2244 wrote to memory of 5088 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 84 PID 2244 wrote to memory of 3240 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 85 PID 2244 wrote to memory of 3240 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 85 PID 2244 wrote to memory of 3240 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 85 PID 2244 wrote to memory of 5048 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 86 PID 2244 wrote to memory of 5048 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 86 PID 2244 wrote to memory of 5048 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 86 PID 2244 wrote to memory of 3588 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 88 PID 2244 wrote to memory of 3588 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 88 PID 2244 wrote to memory of 3588 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 88 PID 2244 wrote to memory of 1028 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 89 PID 2244 wrote to memory of 1028 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 89 PID 2244 wrote to memory of 1028 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 89 PID 2244 wrote to memory of 3720 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 90 PID 2244 wrote to memory of 3720 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 90 PID 2244 wrote to memory of 3720 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 90 PID 2244 wrote to memory of 5112 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 91 PID 2244 wrote to memory of 5112 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 91 PID 2244 wrote to memory of 5112 2244 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 91 PID 5048 wrote to memory of 1720 5048 cmd.exe 96 PID 5048 wrote to memory of 1720 5048 cmd.exe 96 PID 5048 wrote to memory of 1720 5048 cmd.exe 96 PID 5112 wrote to memory of 4624 5112 cmd.exe 97 PID 5112 wrote to memory of 4624 5112 cmd.exe 97 PID 5112 wrote to memory of 4624 5112 cmd.exe 97 PID 1720 wrote to memory of 4712 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 98 PID 1720 wrote to memory of 4712 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 98 PID 1720 wrote to memory of 4712 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 98 PID 4712 wrote to memory of 4216 4712 cmd.exe 100 PID 4712 wrote to memory of 4216 4712 cmd.exe 100 PID 4712 wrote to memory of 4216 4712 cmd.exe 100 PID 1720 wrote to memory of 2164 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 101 PID 1720 wrote to memory of 2164 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 101 PID 1720 wrote to memory of 2164 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 101 PID 1720 wrote to memory of 3920 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 102 PID 1720 wrote to memory of 3920 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 102 PID 1720 wrote to memory of 3920 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 102 PID 1720 wrote to memory of 2328 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 103 PID 1720 wrote to memory of 2328 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 103 PID 1720 wrote to memory of 2328 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 103 PID 1720 wrote to memory of 3132 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 104 PID 1720 wrote to memory of 3132 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 104 PID 1720 wrote to memory of 3132 1720 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 104 PID 3132 wrote to memory of 3292 3132 cmd.exe 109 PID 3132 wrote to memory of 3292 3132 cmd.exe 109 PID 3132 wrote to memory of 3292 3132 cmd.exe 109 PID 4216 wrote to memory of 1888 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 110 PID 4216 wrote to memory of 1888 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 110 PID 4216 wrote to memory of 1888 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 110 PID 4216 wrote to memory of 3712 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 112 PID 4216 wrote to memory of 3712 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 112 PID 4216 wrote to memory of 3712 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 112 PID 4216 wrote to memory of 1828 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 113 PID 4216 wrote to memory of 1828 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 113 PID 4216 wrote to memory of 1828 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 113 PID 4216 wrote to memory of 4660 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 114 PID 4216 wrote to memory of 4660 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 114 PID 4216 wrote to memory of 4660 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 114 PID 4216 wrote to memory of 3084 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 115 PID 4216 wrote to memory of 3084 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 115 PID 4216 wrote to memory of 3084 4216 1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe 115 PID 1888 wrote to memory of 4188 1888 cmd.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\TewMUQYc\jiIAcMcQ.exe"C:\Users\Admin\TewMUQYc\jiIAcMcQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5088
-
-
C:\ProgramData\KGYwIwgA\fckUEYQA.exe"C:\ProgramData\KGYwIwgA\fckUEYQA.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3240
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"2⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes1183⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"4⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes1185⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"6⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes1187⤵
- Suspicious behavior: EnumeratesProcesses
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"8⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes1189⤵
- Suspicious behavior: EnumeratesProcesses
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"10⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11811⤵
- Suspicious behavior: EnumeratesProcesses
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"12⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11813⤵
- Suspicious behavior: EnumeratesProcesses
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"14⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11815⤵
- Suspicious behavior: EnumeratesProcesses
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"16⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11817⤵
- Suspicious behavior: EnumeratesProcesses
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"18⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11819⤵
- Suspicious behavior: EnumeratesProcesses
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"20⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11821⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"22⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11823⤵
- Suspicious behavior: EnumeratesProcesses
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"24⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11825⤵
- Suspicious behavior: EnumeratesProcesses
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"26⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11827⤵
- Suspicious behavior: EnumeratesProcesses
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"28⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11829⤵
- Suspicious behavior: EnumeratesProcesses
PID:3824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"30⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11831⤵
- Suspicious behavior: EnumeratesProcesses
PID:3532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"32⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11833⤵PID:628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"34⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11835⤵PID:3224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"36⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11837⤵PID:2920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"38⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11839⤵PID:1104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"40⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11841⤵PID:792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"42⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11843⤵PID:4312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"44⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11845⤵PID:2280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"46⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11847⤵PID:2164
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"48⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11849⤵PID:2188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"50⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11851⤵PID:1104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"52⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11853⤵PID:3700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"54⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11855⤵PID:3960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"56⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11857⤵PID:4464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"58⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11859⤵PID:3460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"60⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11861⤵PID:324
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"62⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11863⤵PID:716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"64⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11865⤵PID:640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"66⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11867⤵PID:1204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"68⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11869⤵PID:4368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"70⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11871⤵PID:3432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"72⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11873⤵PID:4740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"74⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11875⤵PID:3256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"76⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11877⤵PID:3748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"78⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11879⤵PID:5080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"80⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11881⤵PID:2328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"82⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11883⤵PID:2068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"84⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11885⤵PID:3612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"86⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11887⤵PID:1104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"88⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11889⤵PID:752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"90⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11891⤵PID:2316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"92⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11893⤵PID:4804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"94⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11895⤵PID:2936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"96⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11897⤵PID:1936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"98⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes11899⤵PID:624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"100⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118101⤵PID:3516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"102⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118103⤵PID:4996
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"104⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118105⤵PID:4012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"106⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118107⤵PID:4368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"108⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118109⤵PID:1596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"110⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118111⤵PID:2332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"112⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118113⤵PID:1028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"114⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118115⤵PID:2432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"116⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118117⤵PID:1708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"118⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118119⤵PID:2784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"120⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118121⤵PID:4520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c323571263fae709a03a787aa4416aa_JaffaCakes118"122⤵PID:5112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-