Malware Analysis Report

2024-10-24 16:46

Sample ID 240418-akyevscg6t
Target f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118
SHA256 369e794e05e0d7c9bba6dde5009848087a2cd5e8bf77583d391e0e51d21a52cd
Tags
warzonerat infostealer persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

369e794e05e0d7c9bba6dde5009848087a2cd5e8bf77583d391e0e51d21a52cd

Threat Level: Known bad

The file f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

warzonerat infostealer persistence rat

WarzoneRat, AveMaria

Warzone RAT payload

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-18 00:16

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-18 00:16

Reported

2024-04-18 01:22

Platform

win7-20240221-en

Max time kernel

120s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

Signatures

WarzoneRat, AveMaria

rat infostealer warzonerat

Warzone RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2656 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2656 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2656 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2656 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2656 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2656 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2656 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2656 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2052 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2052 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2052 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2052 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2632 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2632 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2632 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2632 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2688 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2688 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2688 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2632 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2632 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2632 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2632 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2764 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2764 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2764 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2764 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2764 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2764 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2764 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2764 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2764 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2764 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2764 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2764 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2764 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2764 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2764 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2764 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2104 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\WerFault.exe
PID 2104 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\WerFault.exe
PID 2104 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\WerFault.exe
PID 2104 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 200

Network

N/A

Files

C:\Users\Admin\AppData\Local\VLC Media Player.exe

MD5 f6e2893312dc8bb664c183fcc93990bb
SHA1 72c03600b7fcab33db83644153a9376f6aae5914
SHA256 369e794e05e0d7c9bba6dde5009848087a2cd5e8bf77583d391e0e51d21a52cd
SHA512 dbe72bd9d0851176e20091842b1505e650034ce4b1a98dfc13d09cbb92cc45a8db67418ff7db88a4a5451363c74189bf86efe227ec52b6901e1b188bae07baf0

memory/2104-8-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2104-9-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2104-12-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2104-16-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2104-20-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2104-22-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2104-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2104-14-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2104-11-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2104-10-0x0000000000400000-0x0000000000554000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-18 00:16

Reported

2024-04-18 01:21

Platform

win10v2004-20240412-en

Max time kernel

36s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC Media Player = "C:\\Users\\Admin\\AppData\\Local\\VLC Media Player.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4912 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4912 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4912 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4912 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 4912 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 4912 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 4892 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4892 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4892 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5096 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5096 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5096 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5096 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 5096 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 5096 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 4328 wrote to memory of 672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4328 wrote to memory of 672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4328 wrote to memory of 672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3956 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 3956 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 3956 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 4588 wrote to memory of 8 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4588 wrote to memory of 8 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4588 wrote to memory of 8 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5108 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5108 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5108 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5108 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 5108 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 5108 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 3032 wrote to memory of 3952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3032 wrote to memory of 3952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3032 wrote to memory of 3952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4476 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 4476 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 4476 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 2268 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2268 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2268 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3708 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3708 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3708 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3708 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 3708 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 3708 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 860 wrote to memory of 5048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 860 wrote to memory of 5048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 860 wrote to memory of 5048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4364 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4364 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4364 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4364 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 4364 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 4364 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe
PID 4812 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4812 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4812 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3584 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\VLC Media Player.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f6e2893312dc8bb664c183fcc93990bb_JaffaCakes118.exe" "C:\Users\%username%\AppData\Local\VLC Media Player.exe" & REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "VLC Media Player" /t REG_SZ /F /D "C:\Users\%username%\AppData\Local\VLC Media Player.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Network

Country Destination Domain Proto
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 90.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\VLC Media Player.exe

MD5 32934b0b0c13aa683e0af9a4978975a5
SHA1 29711c6ad17dc6564e2a80588ed7daf7fb0bdbe7
SHA256 25f13ad1a5c42ec0976b5032663bdf1f146d8bfe4e8d25e1fcc69f9d8a8ebfdd
SHA512 fa881e829047e80eafcd2486a8561a52879bb59b0ec12150aa71b2bfdf20a7a64e5aad4f6d6349e7f96a8fe0ac9f922e376bf078ae8373b655e7a876307989e9

C:\Users\Admin\AppData\Local\VLC Media Player.exe

MD5 f6e2893312dc8bb664c183fcc93990bb
SHA1 72c03600b7fcab33db83644153a9376f6aae5914
SHA256 369e794e05e0d7c9bba6dde5009848087a2cd5e8bf77583d391e0e51d21a52cd
SHA512 dbe72bd9d0851176e20091842b1505e650034ce4b1a98dfc13d09cbb92cc45a8db67418ff7db88a4a5451363c74189bf86efe227ec52b6901e1b188bae07baf0

C:\Users\Admin\AppData\Local\VLC Media Player.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e