Malware Analysis Report

2024-09-11 05:59

Sample ID 240524-ghadksff3y
Target 6d82825d04621bf440d73415f09701d6_JaffaCakes118
SHA256 65f52c89926ebf5b1c66481caf635a1ff2c98a5044cae16cbce5f26580b2bb06
Tags
discovery evasion execution exploit persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

65f52c89926ebf5b1c66481caf635a1ff2c98a5044cae16cbce5f26580b2bb06

Threat Level: Likely malicious

The file 6d82825d04621bf440d73415f09701d6_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

discovery evasion execution exploit persistence

Creates new service(s)

Stops running service(s)

Possible privilege escalation attempt

Modifies file permissions

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

Launches sc.exe

Drops file in Windows directory

Drops file in Program Files directory

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious behavior: LoadsDriver

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
System Services
T1569
Service Execution
T1569.002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Defense Evasion
TA0005
Impair Defenses
T1562
File and Directory Permissions Modification
T1222
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Service Stop
T1489
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-24 05:47

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-24 05:47

Reported

2024-05-24 05:50

Platform

win7-20240221-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe"

Signatures

Creates new service(s)

persistence execution

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\system32\msvcp60.dll C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WinNexus\Desktop\bin\res\Cht\is-0ONUN.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Cht\is-L5IVO.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\info.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Cht\is-IJ6HD.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\EventRuleCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\info.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Action.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\uuid.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\EventRuleCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Desktop.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WNXUninstall.exe C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\is-091KH.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\SysSoftCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Action.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Desktop.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Cht\is-QPRGS.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Eng\is-3A5TO.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Common\is-ITJQL.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Common\is-CHPA6.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusCommandRunas.exe C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Common\is-T7OUM.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\EventRuleCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\info.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\SysSoftCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\is-DHV1F.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Action.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Desktop.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\SysSoftCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\log4cplus.dll C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\info.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Common\is-NV6N0.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\is-IC6GF.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\info.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\language\Source\is-PMI3A.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Eng\is-0M5FN.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Common\is-S355U.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\language\Source\is-U708S.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\SysSoftCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Desktop.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Chs\is-PRGG5.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Chs\is-OJ5JA.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\EventRuleCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Eng\is-HPTQH.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Common\is-GMDBQ.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Action.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\SysSoftCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Common\is-FBG4V.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\SysSoftCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Desktop.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Desktop.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\EventRuleCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\TMPcmdkey.exe C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Chs\is-NTSFM.tmp C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WinNexusDesktopInstall.log C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
File opened for modification C:\Windows\WNSvcAction.log C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
File created C:\Windows\WNSvc.log C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
File opened for modification C:\Windows\WNSvc.log C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\URL Protocol C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\shell C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\shell\open C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\shell\open\command C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\shell\open\command\ = "C:\\Program Files\\WinNexus\\Desktop\\bin\\WinNexusLoader.exe %1" C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wdf C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wdf\ = "WinNexus WDF file" C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\EditFlags = "65536" C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\DefaultIcon C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\shell\open C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\shell\open\command\ = "\"C:\\Program Files\\WinNexus\\Desktop\\bin\\WinNexusLoader.exe\" \"%1\"" C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\ = "URL:Alert Protocol" C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\BrowserFlags = "8" C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\DefaultIcon\ = "C:\\Program Files\\WinNexus\\Desktop\\bin\\WNAgent.exe" C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\shell\open\command C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\shell C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\DefaultIcon\ = "C:\\Program Files\\WinNexus\\Desktop\\bin\\WNAgent.exe" C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\ C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\DefaultIcon C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2172 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp
PID 2172 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp
PID 2172 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp
PID 2172 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp
PID 2172 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp
PID 2172 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp
PID 2172 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp
PID 2872 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE
PID 2872 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE
PID 2872 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE
PID 2872 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE
PID 2872 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE
PID 2872 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE
PID 2872 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE
PID 2252 wrote to memory of 488 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 488 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 488 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 488 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 488 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 488 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 488 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 488 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 488 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 488 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 488 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 488 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 488 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 488 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2252 wrote to memory of 1556 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 1556 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 1556 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 1556 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 1556 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 1556 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 1556 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2208 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2208 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2208 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2208 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2208 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2208 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2208 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 992 wrote to memory of 1916 N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe
PID 992 wrote to memory of 1916 N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe
PID 992 wrote to memory of 1916 N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe
PID 992 wrote to memory of 1916 N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe
PID 2208 wrote to memory of 452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2208 wrote to memory of 452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2208 wrote to memory of 452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2208 wrote to memory of 452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2208 wrote to memory of 452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2208 wrote to memory of 452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2208 wrote to memory of 452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1556 wrote to memory of 1172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 1556 wrote to memory of 1172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 1556 wrote to memory of 1172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 1556 wrote to memory of 1172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 1556 wrote to memory of 1172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 1556 wrote to memory of 1172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 1556 wrote to memory of 1172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 1556 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 1556 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 1556 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 1556 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp

"C:\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp" /SL5="$5014E,2981840,56832,C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe"

C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE

"C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE" /install

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe

"C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c takeown /f "C:\Windows\WinSxS" && icacls "C:\Windows\WinSxS" /grant administrators:F

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sc create WNPPDx64 binPath= "C:\Windows\SysWOW64\drivers\WNPPDx64.sys" type= "kernel" start= "auto" Displayname= "WNPPDx64"

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\sc.exe

sc create WNPPDx64 binPath= "C:\Windows\SysWOW64\drivers\WNPPDx64.sys" type= "kernel" start= "auto" Displayname= "WNPPDx64"

C:\Windows\SysWOW64\takeown.exe

takeown /f "C:\Windows\WinSxS"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Windows\WinSxS" /grant administrators:F

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sc start WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc start WNPPDx64

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 45771

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 45869

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 45886

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 45902

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 45918

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 45951

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 45984

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46000

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46016

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46052

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46069

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46085

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46101

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46134

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46150

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46166

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46183

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46215

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

Network

Country Destination Domain Proto
US 8.8.8.8:53 winnexus.ct-cloud.cn udp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
N/A 127.0.0.1:45771 tcp
N/A 127.0.0.1:45771 tcp
N/A 127.0.0.1:45771 tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp

Files

memory/2172-0-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2172-2-0x0000000000401000-0x000000000040B000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-6US77.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp

MD5 1305181de520f125aeabf85dc24a89d6
SHA1 98b7548fede3f1468ccbdee405abdc4e5d2ec671
SHA256 0e19765b89a1a29afee09810dcb3ec5cc7c66053947be8f1aebdbb7c801dfeaf
SHA512 b0bfa9749a6a5a18c1926e6c5ebb4cdb156df1652cb822f067422a1cd21583340f32e4a1fc2f4c21a09343d73a55651972edbd2dec98ce44641a1097c16bc793

\Users\Admin\AppData\Local\Temp\is-HCVHR.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/2872-10-0x0000000000400000-0x00000000004BC000-memory.dmp

\Program Files\WinNexus\Desktop\bin\DesktopInstall.exe

MD5 594c3e9e8434c4d7c4a35d5b6925368e
SHA1 ac1f025343bf1c1887143fa347ec39e6609b17f9
SHA256 dc01e3e46d12689d781944e5241ce3330444ccf2c3590e5386932daa26a1ac90
SHA512 7cd97dd07d46fc9c7b2aef059dfcc7d46851d627991de8cba597c0ee147b7c47236fb34a44d810c0a3f871fe7617c5f1d0f2b506f48de6d34017283ebb62a9e2

C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe

MD5 4a490079f8896e8ba0243ca564383581
SHA1 205b00e740c90ebae33c7ae86afcce2649780c3d
SHA256 3a065918086c9ae1d693da1db4e7a40607d5de468fa1ce06a825ec8c9baba273
SHA512 4f361ac44d0b1309e6333161dcf1b316df6084d5949565d32334c5ff6cbe4f5f01069fdca65a560243331821acecba33349d4b18cf23f921abd273acb754af26

C:\Program Files\WinNexus\Desktop\bin\libcurl.dll

MD5 d851cc87246d0abed191f51eaa12795f
SHA1 a794ea4c2b64418dbdad10974f9cd58a2148cc23
SHA256 5b67bc90ed059a68132c08448747bacf65a9bb1a4ef593526b99561e948d010d
SHA512 93b62f51a7c267aa016abf8638425d5eccae204d81b14139b8da57b785b154fb7791ca5b2e0539c2bef5b0fec9b83c32600bbf16b70e3c417107c67ecc7cc3fa

C:\Windows\WNSvcAction.log

MD5 29e3a0fc0dda90bf8d305752475b4b89
SHA1 080eb556dc53c82788d4ab58c3a43bb2749372b9
SHA256 d8cf13b366c9af9cf33fed589c4cbdc874081434ce1bf98c5caf6afaa6a998fb
SHA512 1885b921aa0b07a5573a932bd91d4c60d42c380ea9e741dc81e6d4ea5ea3850308c43b0716c0952c11507418d214da041333333b92a5160eea9f8d59f308a1f0

C:\Program Files\WinNexus\Desktop\bin\Agentcfg.ct

MD5 93ab2d9deb69a06ebeba3a94fb30c510
SHA1 cb5fad62e1f702ccee9ca276219ddb686366dd41
SHA256 0e095fba6aa796b46d8756508d39e70db9b13f7eab39e473689a17838040be80
SHA512 d2a61b14faecdc083066f289facc21b587de7c14cb922f70394599945e21ac3c29e9545f63b8941d40b7222d039ca476067d9ab7d632cd4e894e7419fd2d8b57

C:\Program Files\WinNexus\Desktop\bin\TMPGlobalhookdllx64.dll

MD5 fe140d308c000c96b0a89a871b81c504
SHA1 9ba3bdc859ca25df7cdaf8cf35a3cb5a74a3405a
SHA256 4c3f9b7dba32da182b66844dba4179a84f5631ea4a6a94a09ba547feb56839ab
SHA512 6831093ef1e978270301bc7ef87d45d56c1d392de6c98c5c386956ef76c091bb456a515261ab42be64e0fa0f49642baddf13927e9154a5b1b5e3fec111996681

C:\Program Files\WinNexus\Desktop\bin\TMPglobalhookdll.dll

MD5 cae73486ba5906534780874d3e612487
SHA1 ba2fc64d7699d4dd1079f9f8cca46dbf7e5f8220
SHA256 7191079747612716f69799402fdba3af9aca36ee99fcbfb5358e0d58f9ed5ecd
SHA512 d10e2962e94ea484728d101d345bcba883951aeea95cd393ebbbfe3015b736499391424dfc87ed04d6d85366b7dc007308b292c5697e7df0ebebf2db4745fc65

C:\Program Files\WinNexus\Desktop\bin\TMPcmdkey.exe

MD5 e002c71165d09da89d023433dc15a897
SHA1 5dc36b3c4f71ee7e8db09d9903beadb61831d69b
SHA256 03dbfd2351f2b8e368489f8dda1a58a7eeea0884a34f296d3d425bb149670aec
SHA512 c7b5c427a8dc7f86f7664303ed126ba75e18aab997ce86b12e5959f606ac660c628268ce31b974eac57a3ce179d527d2de1f883e25229cf5343a3387872e778c

\Program Files\WinNexus\Desktop\bin\WNAgent.exe

MD5 6e8bfa492d5fbd8722ac25c96db5bef0
SHA1 1af250e0fcda0079040e4ddda922a4b7caf05760
SHA256 4d986c0d6db16bed50a0cf0110cd950db87c51e722ce9b778f91adb8ef4debd2
SHA512 ef0475a7edaad6c8ccf1ad62b34a554fa41c6986254b71155f0ecefd810ca36219eb264e8f739852523f36b1798100b10609e61d1fa803e78854cf6aa7d7e4cb

\Program Files\WinNexus\Desktop\bin\log4cplus.dll

MD5 a70eda33710cbd69f92e383b27e6821a
SHA1 8f713a7c98fd5462d7725228c0fc4468be9bd238
SHA256 68a0027c6dc4efd8335ef67fcccee9040cba9ce6d31819f1c41c5303d97a0e5d
SHA512 4d3c02a9bcc7dde843c91b10a42c8389087e978079a43b84c99ed757d2af87a9d147914bc10730d84dc3b7cdf1c8ab1dd6bdb3dc22edccd2fb935cbc89681dfa

memory/1916-255-0x0000000000220000-0x0000000000260000-memory.dmp

memory/1916-253-0x0000000000020000-0x0000000000030000-memory.dmp

C:\Program Files\WinNexus\Desktop\bin\log4clpus.cfg

MD5 52fe7a08b10b6e44dcb6e55829994ed0
SHA1 47bf13fe3719ba000522c7b15f6958a0c04c2747
SHA256 2c073e571de8cb5c74119acd238dec99875621ccb22ef7504ae94e759804ed61
SHA512 2f255701b0d995182fb47bd1f9e9227ae622b0acfcb8007477fe7c1c21af715525383554b47c0342c576aed6c018517f3654851168d9ab73a382b56b95d70bb9

C:\Program Files\WinNexus\Desktop\bin\language\ErrorMessage\Desktop_ENG.mwm

MD5 c19be8f3c300e5700f9d931cb2896bce
SHA1 f4806c5bd44ebe8273c89cd84d212a5098c885b9
SHA256 1cf45f2c5b11ea0079bbe635f5fa1064057e4dc5aaa7656b20cdddff2648346a
SHA512 c004871e6a085dde0101bcd49bc45f404cd11dab6948fbc01c97e885831e33b7b6a134d2c87a3849fab358c3ce8ee493ecb587f4313907bc8453fbff7828bc14

C:\Program Files\WinNexus\Desktop\bin\SysSoftCfg.ct

MD5 158a542f739676851d2fdfa1a9813c2a
SHA1 6bf7a0cc9b9cf8e4d7f6a18639ce7735f344b4c3
SHA256 37801653f4be2d0c4d11909d29462e1587f1febd495d3fd271ee12082bff566e
SHA512 11793df9f92e36cf98138bfa626e80b8cf5d165ed30de4b3b735a410ae2cc75b16b3bb63a3b96e6b43efe202ccc4cbcc1b158cb68e55ab59f8cb294c40172651

C:\Program Files\WinNexus\Desktop\bin\language\Source\Eng.ct

MD5 b37c038c0c425b60a3c975223cbc6d5c
SHA1 b813e310223b659b583ff2508444c06abe4fedd4
SHA256 c7c4509264538728e1a8f7bfad0bd09f90e6b5e0d39a51a5a5c58d205b6ba4d5
SHA512 d604ada5ef7e0e1a12abad0c94922f6a9342e247cfafeba64538ba2c61ecc36a72476a7f32143bd97578b139584913b4d625c81d5c8e4fb7310284b50791430f

C:\Program Files\WinNexus\Desktop\bin\res\Eng\add.ico

MD5 756393a68fc08413c9c329f189c0aa00
SHA1 4f51bb6b60b501d7d42435dd726c8dc8029483af
SHA256 fb329a56640a39eee578d903f0248474d35f5ea5b2d59c1126029bbc22399cf2
SHA512 8309b7224580407a8670cc43376deea862ab7b3b7fba5003be7c243927e68ab36317caf05fe287b47537e85e22be2217720410a31a5923a0fc8c26d24b70d20f

C:\Program Files\WinNexus\Desktop\bin\res\Eng\stop.ico

MD5 70d02b31fe6a9e6443b532256195a38a
SHA1 064481c7597fea1cada3d58db54110d5d5b7f7f9
SHA256 9a9bf27435e2f47ca2626566a4b0ee083c920951530363f731f3caad5c081b75
SHA512 c739470c1f5d16dd0e966702ef23d6d088a0229855ced74172ff78c48762be82a18c89462ad587f96229c943c3cb50ae87e321f0249dc4c141fb2879f52c5759

C:\Program Files\WinNexus\Desktop\bin\res\Eng\run.ico

MD5 9e4a3ff8da85a85c6874c6d539206bdc
SHA1 fc2ed3f1a53d0a8ac153b6eb55d986ac3e268b0c
SHA256 e025fc00022b3230c445e6df9460eb739cc1c50f9b38a14027e3bb429b963453
SHA512 16755949d56112e8961b02a2e77c4463dcd3d637c528f77761e4b818dab18bc49d6e84e012fc83828d2dd5b91496b2d0d04bc09a4aca76fa58d7a75d64a706aa

C:\Program Files\WinNexus\Desktop\bin\res\Eng\remove.ico

MD5 b7e98473ce90e85bbeb15bc7d2294496
SHA1 7cc535871800ef24119dafd83eab69c7a9219a3d
SHA256 68f63f4f8ff8e60063ab38b023862d40c6d3eab204fdc84144db4e9b796dcd61
SHA512 ca24fd610a5e3910f42dd9290c4ae02e934b05ee2152208960b6b5e9674afddaae6bb449cc990c4e2f9f3dbec92678610fada64b041b3392a494f0134b18ceef

C:\Program Files\WinNexus\Desktop\bin\res\Common\TabBar.jpg

MD5 7581c56594040792d4e3dc6143bcd77a
SHA1 24e60c55119a2d4aedde4207f3ad2732d85f7425
SHA256 cc5cdf83f4543f5875f448d83dc9aadde8c460e953d2a2e5b425eb9e9a46bca4
SHA512 4a7bd62f70136dcb0406bda1a36e1373ef36194d3866d63a768745f1695ec559421d0f34a82c08f1b820d8dab3afd97c46d47e16a62f64c2367e715c8860ad11

C:\Program Files\WinNexus\Desktop\bin\res\Common\SlideBar.jpg

MD5 2964ddab79c99c415194a166fe42b886
SHA1 aea3cf6a7858039b5712746fba949d58f0dc1ffd
SHA256 fdc1ca7b5b1192b9c0e41baa00e2c160c3eed697600f3a82e5617b43fad01063
SHA512 ec233543cf3847e7b7456f6eef6e579f0011789c13a103fa16bbff2b4093f7e86b10e787f8c0a98f6dd06edeeb48f9b12f83aca0bd0d7b0adcffa4b7b7edc151

\Program Files\WinNexus\Desktop\bin\WNMonitor.exe

MD5 5a28de55e1459ba5e3d02624cf07365b
SHA1 3362ebae5af7b63865a1979c771fb1a5c52ff647
SHA256 0b6cabcf23677958881981603b8cd2b1143fb11279eab0b2d3bde4110a4e3da1
SHA512 998fee3ae53396fc4a56897ecfc2b8b54c3584059af18b60b14608d929f15647f979ad9972fab76fdcade352b640e278b6c38c87f573e4005c50e7fdffc35043

C:\Program Files\WinNexus\Desktop\bin\res\Eng\NetworkTab.ico

MD5 0a44b95765a43941c9baf3b968aec3c5
SHA1 72f48b2420933aa174efcdcaca94cdddda416c33
SHA256 baf4edb08ca48232c39f9691438dc01817188dcc950162d9ff35027d8f3bea16
SHA512 0523bc26cab672f91bc8b34968d96460e4fe95d26103fb44e597d64332c76b6720240d0fd4cef9b374889ba16572ddb353b56ddaf533a367aae0e1af231a06c5

C:\Program Files\WinNexus\Desktop\bin\res\Eng\AboutTab.ico

MD5 fc0f806ee37e100c487a0f2a0aa24e94
SHA1 143a274d75b2a8e1a960de68c9d3874daa3a6606
SHA256 317d74281c96f556cb6633f6faf0c27e638c60a2d4fd54487dc8312738b1d818
SHA512 e6eb281a89a42eb2bf4f326a145fd7649d5cc5b43adfdb3a67978f257ff2b1d9bb58caa11cc0b6168f9274a49fcaa1fead64690b552d82f5d47d97b7e4e395c5

C:\Program Files\WinNexus\Desktop\bin\res\Eng\FileTypeTab.ico

MD5 1281dcec1140388c17bf4ded769a4843
SHA1 c0200fef39db64f4af71a4ef5a6790a6a6b4a176
SHA256 0216a0116cb281f29f2e6e975e9d020b0ca54d4cfa1ac1e7fecf8e9720199e18
SHA512 f4653b8e3a49b8e33976ac720560166eb936ffdb4bdc53a94cabb0461ead21657bf55630fc7ebb108115f67a156df1d1e123e32bf4a494f69356aa3892cfdcd5

C:\Program Files\WinNexus\Desktop\bin\res\Eng\ApplicationTab_Enable.ico

MD5 94207d5485f5c86f6b26c45711df99b5
SHA1 0b66eb515811d6933ce66c8dfa0dc2d5e4942d0a
SHA256 fee842c932e30dc0cd9ef9a060cebca5208166585153e7277d4d4e0067de59f0
SHA512 f0f5c75f24546b7214289d9a32ca07dafe4f5380d79936a3f02796ac84686ac0455f85346aa0cc654652bb81a7dcab3e091ab71cb5fd3c1bb4385617ee670851

memory/2172-283-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2872-282-0x0000000000400000-0x00000000004BC000-memory.dmp

C:\Windows\WNSvcAction.log

MD5 61f7e5ba0e86c65c9c6589b06c6a7d66
SHA1 b3d7076cb36e59c0b2424ac8c205c5a0cb2231f6
SHA256 7c1fc176869892ad3a407040d50fada692d7eb5e4db8047e40ffc02c14e0e86b
SHA512 5962096bfb7d2302ff941a482916b4937bc4bc81276181492eb5f2a578dd209afdd9dedacb00757146c24aaeb2a775511af32e93a12da177a667f721bd53b23e

memory/2404-308-0x00000000001B0000-0x00000000001F0000-memory.dmp

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\info.log

MD5 6281609ac2e08d8dd620c7df5c52b7a7
SHA1 8501e65ccf1336b5a9e9b496f82f609d0dec4705
SHA256 9d7f7607ff14ea7d10263e1150382394be6fbb060836d6a5ce706a8499f22007
SHA512 281d6124e949e5ad72f22cc091894ff1f6df0407582b60cd0479d6af11da4df814bbc0e1afc8c96aae2cd19c244cca812a08aa619715dacde9b02b42a7b5d06f

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log

MD5 47eea4f05f38e3bc17976a44af2dd634
SHA1 4727384226235317dfce8ec6a586770999b4cf37
SHA256 17974d22e19c400f1183d8362f7f3c3faec6cccbdbfcb29fe35fac4c5e7145c1
SHA512 809fbf67ef927ecf72ef5ee51604a860d8c021c8998a1ead69d027f7a17d718b980430296a038cacb9c9441d12c0c11b17e26e1dce6a75f232c87bc633b7db7f

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Action.log

MD5 4fc7772f1ffe8933db7adb4671caeb08
SHA1 5c90f8c080a0fb24b1f06890fd952594da687f11
SHA256 4d2c0eda4ae2aaa4fc717111e1c0fc236789df5311e09721bff266647a57b7b1
SHA512 a809d0c096807606e1d58068d995a6fea770dfc12b316470e6039c5e607d53803add627eb5ffda19124955b40f6f5b85a476b0bfd487e83e723c0ac5f40ec081

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Desktop.log

MD5 b19f7ad22facd1ca23d51f2f6787ebc2
SHA1 205b4eca59b5a6af91cf504191e03d9ac1374931
SHA256 47c905af3e4a1aa42decb6cb05eef6ef4ee93b2129c2b8bfaa193ab330fcf33a
SHA512 b1657ead3432243fa53488f39a2fbf1dc1c63b9fd1f97f9c1e5de12d5649830e28874bf8b2fa5d9cb4f9a51f1b9254d6902bf127b744cb8ad142e1509e7a5497

memory/2692-336-0x00000000002A0000-0x00000000002E0000-memory.dmp

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\info.log

MD5 fe2072411ec77c6c906f205de6fc5473
SHA1 78cee51c82543cd81dead39d4fa964a1732af6d9
SHA256 c2b4b5c3a2295374b474965a528ec1bbc0d0fae4035fab7b5f703ec2626bc5c4
SHA512 e75a660b85d9f70aa58461d1324526af49838bd82bfc6d1273138de0439215a3bdd44d6e4ec300949b099646ac5de3e6f8e9763b116f0849742910b8dad7d508

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Desktop.log

MD5 2b3ba5aa8258263621dabc975892d685
SHA1 62515c128e917a25bdcab5de402f2015831b0b09
SHA256 c2f1c36aad1858dd31b0ceb88dc750606bb068dd73ce57606a6647a684b1bd3d
SHA512 a66b9ec9fd69e22595017ad22cd71868b49532da6da981058571940495566bd19a9efeced635939ee01a8759246e2a9acaa518b615bf6729c939a04be592e5ac

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Action.log

MD5 f7f46fcbfa8cb497a7a2d7c9ddb55284
SHA1 503ff6ef7d7c41a0ebe9952b3cb5ab1eaf9895bf
SHA256 ced016ce1fac67806383173d643ee2eac373099a89566ecedf197c80436ded1d
SHA512 f48c623221842031188529a6f24df48b148cf4814b49b9a56dddf51708b471d4049eda6d1c8fd3fea114ce9b60177f2a5200c95f28976dcd1ccc4f2ed5501776

memory/2380-416-0x00000000002C0000-0x0000000000300000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-24 05:47

Reported

2024-05-24 05:50

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe"

Signatures

Creates new service(s)

persistence execution

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A N/A N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\msvcp60.dll C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\EventRuleCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Common\is-T4CVM.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\is-67NNE.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\SysSoftCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\TMPglobalhookdll.dll C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\EventRuleCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Eng\is-TTPFE.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Common\is-LD9DE.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\Allow_text1.txt C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Action.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\info.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\SysSoftCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\info.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\is-0M2PS.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\is-TEHM3.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Cht\is-ACJCV.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\EventRuleCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Cht\is-SMOJL.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Eng\is-UMGG0.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\SysSoftCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\EventRuleCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Cht\is-A7MSQ.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Chs\is-BFD8G.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Cht\is-FGUQS.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Action.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\TMPcmdkey.exe C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Cht\is-643M8.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Desktop.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\SysSoftCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Desktop.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\libcurl.dll C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\is-OK80O.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\is-30MMC.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\EventRuleCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Common\is-3KPJ8.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Common\is-VFBNG.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Desktop.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\language\ErrorMessage\is-GQ6C2.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Chs\is-KBJO5.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Chs\is-V07D9.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Common\is-8H0TC.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\SysSoftCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Chs\is-F9LIS.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Cht\is-5C5RH.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Cht\is-AM2EB.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Eng\is-TU8SE.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Common\is-A97TV.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\EventRuleCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Chs\is-6ONLD.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Action.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\EventRuleCfg.ct C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\info.log C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Cht\is-SSNGQ.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File created C:\Program Files\WinNexus\Desktop\bin\res\Cht\is-D41RC.tmp C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
File opened for modification C:\Program Files\WinNexus\Desktop\bin\globalhookdll.dll C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WinNexusDesktopInstall.log C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
File opened for modification C:\Windows\WNSvcAction.log C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
File created C:\Windows\WNSvc.log C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
File opened for modification C:\Windows\WNSvc.log C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wdf C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\shell\open\command C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\shell\open C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\shell\open\command\ = "\"C:\\Program Files\\WinNexus\\Desktop\\bin\\WinNexusLoader.exe\" \"%1\"" C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\shell\open\command C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\shell C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\shell\open C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wdf\ = "WinNexus WDF file" C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\EditFlags = "65536" C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\ = "URL:Alert Protocol" C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\DefaultIcon\ = "C:\\Program Files\\WinNexus\\Desktop\\bin\\WNAgent.exe" C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\URL Protocol C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\shell C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\DefaultIcon C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\DefaultIcon\ = "C:\\Program Files\\WinNexus\\Desktop\\bin\\WNAgent.exe" C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\shell\open\command\ = "C:\\Program Files\\WinNexus\\Desktop\\bin\\WinNexusLoader.exe %1" C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WinNexus WDF file\BrowserFlags = "8" C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winnexus\DefaultIcon C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe N/A
N/A N/A C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1816 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp
PID 1816 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp
PID 1816 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp
PID 264 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE
PID 264 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE
PID 264 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE
PID 3972 wrote to memory of 1744 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 3972 wrote to memory of 1744 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 3972 wrote to memory of 1744 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 1744 wrote to memory of 4224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1744 wrote to memory of 4224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1744 wrote to memory of 4224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3972 wrote to memory of 3128 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 3972 wrote to memory of 3128 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 3972 wrote to memory of 3128 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 3972 wrote to memory of 3864 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 3972 wrote to memory of 3864 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 3972 wrote to memory of 3864 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 3864 wrote to memory of 2872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3864 wrote to memory of 2872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3864 wrote to memory of 2872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4588 wrote to memory of 4476 N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe
PID 4588 wrote to memory of 4476 N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe
PID 4588 wrote to memory of 4476 N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe
PID 3128 wrote to memory of 552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 3128 wrote to memory of 552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 3128 wrote to memory of 552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 3128 wrote to memory of 4776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 3128 wrote to memory of 4776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 3128 wrote to memory of 4776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 3972 wrote to memory of 392 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 3972 wrote to memory of 392 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 3972 wrote to memory of 392 N/A C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE C:\Windows\SysWOW64\cmd.exe
PID 392 wrote to memory of 1204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 392 wrote to memory of 1204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 392 wrote to memory of 1204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4476 wrote to memory of 2620 N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 2620 N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 2620 N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 1852 N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe
PID 4476 wrote to memory of 1852 N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe
PID 2620 wrote to memory of 4556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2620 wrote to memory of 4556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2620 wrote to memory of 4556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4588 wrote to memory of 4864 N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe
PID 4588 wrote to memory of 4864 N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe
PID 4588 wrote to memory of 4864 N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe
PID 4864 wrote to memory of 4852 N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 4852 N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 4852 N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Windows\SysWOW64\cmd.exe
PID 4852 wrote to memory of 2364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4852 wrote to memory of 2364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4852 wrote to memory of 2364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4864 wrote to memory of 4256 N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe
PID 4864 wrote to memory of 4256 N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe
PID 4588 wrote to memory of 2620 N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe
PID 4588 wrote to memory of 2620 N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe
PID 4588 wrote to memory of 2620 N/A C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe
PID 2620 wrote to memory of 4680 N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 4680 N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 4680 N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 3812 N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe
PID 2620 wrote to memory of 3812 N/A C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe
PID 4680 wrote to memory of 2084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp

"C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp" /SL5="$70170,2981840,56832,C:\Users\Admin\AppData\Local\Temp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.exe"

C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE

"C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.EXE" /install

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe

"C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c takeown /f "C:\Windows\WinSxS" && icacls "C:\Windows\WinSxS" /grant administrators:F

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sc create WNPPDx64 binPath= "C:\Windows\SysWOW64\drivers\WNPPDx64.sys" type= "kernel" start= "auto" Displayname= "WNPPDx64"

C:\Windows\SysWOW64\sc.exe

sc create WNPPDx64 binPath= "C:\Windows\SysWOW64\drivers\WNPPDx64.sys" type= "kernel" start= "auto" Displayname= "WNPPDx64"

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\takeown.exe

takeown /f "C:\Windows\WinSxS"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Windows\WinSxS" /grant administrators:F

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sc start WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc start WNPPDx64

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 45778

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 45876

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 45909

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 45925

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 45941

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 45974

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46010

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46026

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46042

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46075

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46091

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46108

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46124

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46157

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46189

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46206

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

"C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe" /startup

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop WNPPDx64

C:\Windows\SysWOW64\sc.exe

sc stop WNPPDx64

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

"C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe" 46225

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 winnexus.ct-cloud.cn udp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
N/A 127.0.0.1:45778 tcp
N/A 127.0.0.1:45778 tcp
N/A 127.0.0.1:45778 tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
HK 107.148.52.212:8080 winnexus.ct-cloud.cn tcp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp

Files

memory/1816-0-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1816-3-0x0000000000401000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-A2NO6.tmp\6d82825d04621bf440d73415f09701d6_JaffaCakes118.tmp

MD5 1305181de520f125aeabf85dc24a89d6
SHA1 98b7548fede3f1468ccbdee405abdc4e5d2ec671
SHA256 0e19765b89a1a29afee09810dcb3ec5cc7c66053947be8f1aebdbb7c801dfeaf
SHA512 b0bfa9749a6a5a18c1926e6c5ebb4cdb156df1652cb822f067422a1cd21583340f32e4a1fc2f4c21a09343d73a55651972edbd2dec98ce44641a1097c16bc793

memory/264-7-0x0000000000400000-0x00000000004BC000-memory.dmp

C:\Program Files\WinNexus\Desktop\bin\DesktopInstall.exe

MD5 594c3e9e8434c4d7c4a35d5b6925368e
SHA1 ac1f025343bf1c1887143fa347ec39e6609b17f9
SHA256 dc01e3e46d12689d781944e5241ce3330444ccf2c3590e5386932daa26a1ac90
SHA512 7cd97dd07d46fc9c7b2aef059dfcc7d46851d627991de8cba597c0ee147b7c47236fb34a44d810c0a3f871fe7617c5f1d0f2b506f48de6d34017283ebb62a9e2

C:\Program Files\WinNexus\Desktop\bin\WNSvc.exe

MD5 4a490079f8896e8ba0243ca564383581
SHA1 205b00e740c90ebae33c7ae86afcce2649780c3d
SHA256 3a065918086c9ae1d693da1db4e7a40607d5de468fa1ce06a825ec8c9baba273
SHA512 4f361ac44d0b1309e6333161dcf1b316df6084d5949565d32334c5ff6cbe4f5f01069fdca65a560243331821acecba33349d4b18cf23f921abd273acb754af26

C:\Program Files\WinNexus\Desktop\bin\libcurl.dll

MD5 d851cc87246d0abed191f51eaa12795f
SHA1 a794ea4c2b64418dbdad10974f9cd58a2148cc23
SHA256 5b67bc90ed059a68132c08448747bacf65a9bb1a4ef593526b99561e948d010d
SHA512 93b62f51a7c267aa016abf8638425d5eccae204d81b14139b8da57b785b154fb7791ca5b2e0539c2bef5b0fec9b83c32600bbf16b70e3c417107c67ecc7cc3fa

C:\Windows\WNSvcAction.log

MD5 4b7709a6cdc80d4750cbda3933301f1d
SHA1 fe028f3bde32c1ab4796cf0b9f198f7eaa8a6ec3
SHA256 4a99611b55cc179d009dc1af429cc243fad17039e2cb67024b8ffad36396375f
SHA512 f0944aa7af8feb8b8abac46c761ed0d6fa4f24c0af91c99c6b10da3e4fa2f4f2b22561970fb2093bdb5558fd5184c947005667bde5f301681cf1647e9dabd8c3

C:\Program Files\WinNexus\Desktop\bin\Agentcfg.ct

MD5 93ab2d9deb69a06ebeba3a94fb30c510
SHA1 cb5fad62e1f702ccee9ca276219ddb686366dd41
SHA256 0e095fba6aa796b46d8756508d39e70db9b13f7eab39e473689a17838040be80
SHA512 d2a61b14faecdc083066f289facc21b587de7c14cb922f70394599945e21ac3c29e9545f63b8941d40b7222d039ca476067d9ab7d632cd4e894e7419fd2d8b57

C:\Program Files\WinNexus\Desktop\bin\TMPglobalhookdll.dll

MD5 cae73486ba5906534780874d3e612487
SHA1 ba2fc64d7699d4dd1079f9f8cca46dbf7e5f8220
SHA256 7191079747612716f69799402fdba3af9aca36ee99fcbfb5358e0d58f9ed5ecd
SHA512 d10e2962e94ea484728d101d345bcba883951aeea95cd393ebbbfe3015b736499391424dfc87ed04d6d85366b7dc007308b292c5697e7df0ebebf2db4745fc65

C:\Program Files\WinNexus\Desktop\bin\TMPcmdkey.exe

MD5 e002c71165d09da89d023433dc15a897
SHA1 5dc36b3c4f71ee7e8db09d9903beadb61831d69b
SHA256 03dbfd2351f2b8e368489f8dda1a58a7eeea0884a34f296d3d425bb149670aec
SHA512 c7b5c427a8dc7f86f7664303ed126ba75e18aab997ce86b12e5959f606ac660c628268ce31b974eac57a3ce179d527d2de1f883e25229cf5343a3387872e778c

C:\Program Files\WinNexus\Desktop\bin\TMPGlobalhookdllx64.dll

MD5 fe140d308c000c96b0a89a871b81c504
SHA1 9ba3bdc859ca25df7cdaf8cf35a3cb5a74a3405a
SHA256 4c3f9b7dba32da182b66844dba4179a84f5631ea4a6a94a09ba547feb56839ab
SHA512 6831093ef1e978270301bc7ef87d45d56c1d392de6c98c5c386956ef76c091bb456a515261ab42be64e0fa0f49642baddf13927e9154a5b1b5e3fec111996681

C:\Program Files\WinNexus\Desktop\bin\WNAgent.exe

MD5 6e8bfa492d5fbd8722ac25c96db5bef0
SHA1 1af250e0fcda0079040e4ddda922a4b7caf05760
SHA256 4d986c0d6db16bed50a0cf0110cd950db87c51e722ce9b778f91adb8ef4debd2
SHA512 ef0475a7edaad6c8ccf1ad62b34a554fa41c6986254b71155f0ecefd810ca36219eb264e8f739852523f36b1798100b10609e61d1fa803e78854cf6aa7d7e4cb

C:\Program Files\WinNexus\Desktop\bin\log4cplus.dll

MD5 a70eda33710cbd69f92e383b27e6821a
SHA1 8f713a7c98fd5462d7725228c0fc4468be9bd238
SHA256 68a0027c6dc4efd8335ef67fcccee9040cba9ce6d31819f1c41c5303d97a0e5d
SHA512 4d3c02a9bcc7dde843c91b10a42c8389087e978079a43b84c99ed757d2af87a9d147914bc10730d84dc3b7cdf1c8ab1dd6bdb3dc22edccd2fb935cbc89681dfa

memory/4476-248-0x00000000006D0000-0x0000000000713000-memory.dmp

memory/4476-246-0x0000000000690000-0x00000000006D0000-memory.dmp

C:\Program Files\WinNexus\Desktop\bin\log4clpus.cfg

MD5 52fe7a08b10b6e44dcb6e55829994ed0
SHA1 47bf13fe3719ba000522c7b15f6958a0c04c2747
SHA256 2c073e571de8cb5c74119acd238dec99875621ccb22ef7504ae94e759804ed61
SHA512 2f255701b0d995182fb47bd1f9e9227ae622b0acfcb8007477fe7c1c21af715525383554b47c0342c576aed6c018517f3654851168d9ab73a382b56b95d70bb9

C:\Program Files\WinNexus\Desktop\bin\language\ErrorMessage\Desktop_ENG.mwm

MD5 c19be8f3c300e5700f9d931cb2896bce
SHA1 f4806c5bd44ebe8273c89cd84d212a5098c885b9
SHA256 1cf45f2c5b11ea0079bbe635f5fa1064057e4dc5aaa7656b20cdddff2648346a
SHA512 c004871e6a085dde0101bcd49bc45f404cd11dab6948fbc01c97e885831e33b7b6a134d2c87a3849fab358c3ce8ee493ecb587f4313907bc8453fbff7828bc14

C:\Program Files\WinNexus\Desktop\bin\SysSoftCfg.ct

MD5 158a542f739676851d2fdfa1a9813c2a
SHA1 6bf7a0cc9b9cf8e4d7f6a18639ce7735f344b4c3
SHA256 37801653f4be2d0c4d11909d29462e1587f1febd495d3fd271ee12082bff566e
SHA512 11793df9f92e36cf98138bfa626e80b8cf5d165ed30de4b3b735a410ae2cc75b16b3bb63a3b96e6b43efe202ccc4cbcc1b158cb68e55ab59f8cb294c40172651

C:\Program Files\WinNexus\Desktop\bin\language\Source\Eng.ct

MD5 b37c038c0c425b60a3c975223cbc6d5c
SHA1 b813e310223b659b583ff2508444c06abe4fedd4
SHA256 c7c4509264538728e1a8f7bfad0bd09f90e6b5e0d39a51a5a5c58d205b6ba4d5
SHA512 d604ada5ef7e0e1a12abad0c94922f6a9342e247cfafeba64538ba2c61ecc36a72476a7f32143bd97578b139584913b4d625c81d5c8e4fb7310284b50791430f

C:\Program Files\WinNexus\Desktop\bin\res\Eng\add.ico

MD5 756393a68fc08413c9c329f189c0aa00
SHA1 4f51bb6b60b501d7d42435dd726c8dc8029483af
SHA256 fb329a56640a39eee578d903f0248474d35f5ea5b2d59c1126029bbc22399cf2
SHA512 8309b7224580407a8670cc43376deea862ab7b3b7fba5003be7c243927e68ab36317caf05fe287b47537e85e22be2217720410a31a5923a0fc8c26d24b70d20f

C:\Program Files\WinNexus\Desktop\bin\res\Eng\remove.ico

MD5 b7e98473ce90e85bbeb15bc7d2294496
SHA1 7cc535871800ef24119dafd83eab69c7a9219a3d
SHA256 68f63f4f8ff8e60063ab38b023862d40c6d3eab204fdc84144db4e9b796dcd61
SHA512 ca24fd610a5e3910f42dd9290c4ae02e934b05ee2152208960b6b5e9674afddaae6bb449cc990c4e2f9f3dbec92678610fada64b041b3392a494f0134b18ceef

C:\Program Files\WinNexus\Desktop\bin\res\Common\SlideBar.jpg

MD5 2964ddab79c99c415194a166fe42b886
SHA1 aea3cf6a7858039b5712746fba949d58f0dc1ffd
SHA256 fdc1ca7b5b1192b9c0e41baa00e2c160c3eed697600f3a82e5617b43fad01063
SHA512 ec233543cf3847e7b7456f6eef6e579f0011789c13a103fa16bbff2b4093f7e86b10e787f8c0a98f6dd06edeeb48f9b12f83aca0bd0d7b0adcffa4b7b7edc151

C:\Program Files\WinNexus\Desktop\bin\res\Eng\ApplicationTab_Enable.ico

MD5 94207d5485f5c86f6b26c45711df99b5
SHA1 0b66eb515811d6933ce66c8dfa0dc2d5e4942d0a
SHA256 fee842c932e30dc0cd9ef9a060cebca5208166585153e7277d4d4e0067de59f0
SHA512 f0f5c75f24546b7214289d9a32ca07dafe4f5380d79936a3f02796ac84686ac0455f85346aa0cc654652bb81a7dcab3e091ab71cb5fd3c1bb4385617ee670851

C:\Program Files\WinNexus\Desktop\bin\wnmonitor.exe

MD5 5a28de55e1459ba5e3d02624cf07365b
SHA1 3362ebae5af7b63865a1979c771fb1a5c52ff647
SHA256 0b6cabcf23677958881981603b8cd2b1143fb11279eab0b2d3bde4110a4e3da1
SHA512 998fee3ae53396fc4a56897ecfc2b8b54c3584059af18b60b14608d929f15647f979ad9972fab76fdcade352b640e278b6c38c87f573e4005c50e7fdffc35043

C:\Program Files\WinNexus\Desktop\bin\res\Eng\AboutTab.ico

MD5 fc0f806ee37e100c487a0f2a0aa24e94
SHA1 143a274d75b2a8e1a960de68c9d3874daa3a6606
SHA256 317d74281c96f556cb6633f6faf0c27e638c60a2d4fd54487dc8312738b1d818
SHA512 e6eb281a89a42eb2bf4f326a145fd7649d5cc5b43adfdb3a67978f257ff2b1d9bb58caa11cc0b6168f9274a49fcaa1fead64690b552d82f5d47d97b7e4e395c5

C:\Program Files\WinNexus\Desktop\bin\res\Eng\FileTypeTab.ico

MD5 1281dcec1140388c17bf4ded769a4843
SHA1 c0200fef39db64f4af71a4ef5a6790a6a6b4a176
SHA256 0216a0116cb281f29f2e6e975e9d020b0ca54d4cfa1ac1e7fecf8e9720199e18
SHA512 f4653b8e3a49b8e33976ac720560166eb936ffdb4bdc53a94cabb0461ead21657bf55630fc7ebb108115f67a156df1d1e123e32bf4a494f69356aa3892cfdcd5

C:\Program Files\WinNexus\Desktop\bin\res\Eng\NetworkTab.ico

MD5 0a44b95765a43941c9baf3b968aec3c5
SHA1 72f48b2420933aa174efcdcaca94cdddda416c33
SHA256 baf4edb08ca48232c39f9691438dc01817188dcc950162d9ff35027d8f3bea16
SHA512 0523bc26cab672f91bc8b34968d96460e4fe95d26103fb44e597d64332c76b6720240d0fd4cef9b374889ba16572ddb353b56ddaf533a367aae0e1af231a06c5

C:\Program Files\WinNexus\Desktop\bin\res\Common\TabBar.jpg

MD5 7581c56594040792d4e3dc6143bcd77a
SHA1 24e60c55119a2d4aedde4207f3ad2732d85f7425
SHA256 cc5cdf83f4543f5875f448d83dc9aadde8c460e953d2a2e5b425eb9e9a46bca4
SHA512 4a7bd62f70136dcb0406bda1a36e1373ef36194d3866d63a768745f1695ec559421d0f34a82c08f1b820d8dab3afd97c46d47e16a62f64c2367e715c8860ad11

C:\Program Files\WinNexus\Desktop\bin\res\Eng\run.ico

MD5 9e4a3ff8da85a85c6874c6d539206bdc
SHA1 fc2ed3f1a53d0a8ac153b6eb55d986ac3e268b0c
SHA256 e025fc00022b3230c445e6df9460eb739cc1c50f9b38a14027e3bb429b963453
SHA512 16755949d56112e8961b02a2e77c4463dcd3d637c528f77761e4b818dab18bc49d6e84e012fc83828d2dd5b91496b2d0d04bc09a4aca76fa58d7a75d64a706aa

C:\Program Files\WinNexus\Desktop\bin\res\Eng\stop.ico

MD5 70d02b31fe6a9e6443b532256195a38a
SHA1 064481c7597fea1cada3d58db54110d5d5b7f7f9
SHA256 9a9bf27435e2f47ca2626566a4b0ee083c920951530363f731f3caad5c081b75
SHA512 c739470c1f5d16dd0e966702ef23d6d088a0229855ced74172ff78c48762be82a18c89462ad587f96229c943c3cb50ae87e321f0249dc4c141fb2879f52c5759

memory/264-277-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/1816-278-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Windows\WNSvcAction.log

MD5 3e1abd987a4d03dfc3cdc79feef9ffd1
SHA1 2251952cc8b1081bfdd1e43bb1ddca11a40161c6
SHA256 44ce92bdc60c2c2742d3bf0aeb9194f13fa4706c28e0634482862d801174fb7c
SHA512 3d3d91ed3ecb3c30c60388f34201cb900f33fcfbbf64cb6b846fa0ee847188bf1528fbc43a75a8e185d7266d2da2e1ca3088fbbfb890a6087132d01dc93f81a8

memory/4864-304-0x0000000000840000-0x0000000000880000-memory.dmp

memory/4864-303-0x0000000000700000-0x0000000000710000-memory.dmp

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Desktop.log

MD5 5b90842c0a8294b052411cb35c5494d1
SHA1 e43b771962d85526d2ce60afe36c7c7faedefcab
SHA256 898bd3c557e5924ee934ddd35447648cec3aa279408771a50e823bb7086dea22
SHA512 3a36fe8d227ae5030a56898d4ef32af2293a2a833dd0571573a40f941c077539e833f3e7ca0636fb4bb76d93ad3dea0023b88996365751cb6cc76812eac6f065

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Action.log

MD5 c8e85139de06a52620dca4fffffdb311
SHA1 139c4113d8d70b3b0872699e0dbae47053cc71cb
SHA256 2718e6b9fd4d69e52dd9a5b664feb8030bf746aa42b403ddf77fc8d1da60f5ce
SHA512 6d20ed6a8f7fa641d17e70f9cccaf47af1e4f67d6d43f4321db60eae6f8c80d2912bdcf58b43cc439e3e325d98aa969f7b0912533e208b430074bfe90441eef1

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log

MD5 37f3e22a796f948addd09308aea0bf2f
SHA1 da4f49add325c8e28559dbfb556b331f12e85336
SHA256 c1dfdaba028d038efc68e476ca73f5eea3ec868bb8bb747aa7c543e8e69543ac
SHA512 7a8605e68b8d1b1856278a9c7fc3dd4128122acc51c269829f0215669fc8dc761c899236ae17131ae53a42f81d9409b5e723ebe677824bbb58b167df808a7976

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\info.log

MD5 87d6083dfeefe7fd1465b52f2949f077
SHA1 a89e25189a0bd866d5c088f66c2832e596970804
SHA256 11c1066382719f027a3e62ab2c92265300431229dace0319ab7c4c11248dac53
SHA512 6902ff3a4080f8475fc8faa80e7cb85873896dedf3d0d2fae025a2dd11ff2db490bfb1acfd6052647138f3b0cb328f42d73e12b36b3a03b59c7b3d59fbeb7e86

memory/2620-325-0x0000000000A30000-0x0000000000A70000-memory.dmp

memory/2620-323-0x0000000000710000-0x0000000000720000-memory.dmp

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\info.log

MD5 ad2cf999126b7c775cd8adb863de4785
SHA1 2ab7c0e841624c78163284b0065f179a90e304c4
SHA256 94cea4ee09c002fd4468080719dfa5721374ebecd9270c55b113dd9f97cea179
SHA512 6894fbefe22624c90842f6d719acf1a1156f47bb0809ab99b3486b4854f0360a3529b1add40c3098dd234b6da8c8b27559eb778fab25627046e058fd204eca7e

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Error.log

MD5 6a920a156372f062d7e15447f8db9ea6
SHA1 161b7d2bd1ba2883c9ad6be9b457e06f78aa7fc9
SHA256 7ae01dab5aee44596e30097044f260b46e002850740087fb10e72443bfa558e2
SHA512 7637cf7ba2dceb8ec9c636a28929db17b73bc582e0f648f2020f2d90c32685090b232180a76aae0c37c3f5427191309d18fc7e9c2a290f76b94d89e8d6410b3c

memory/4248-333-0x0000000000630000-0x0000000000640000-memory.dmp

memory/4248-334-0x0000000000650000-0x0000000000690000-memory.dmp

memory/2916-341-0x0000000000A20000-0x0000000000A60000-memory.dmp

memory/2916-340-0x0000000000A10000-0x0000000000A20000-memory.dmp

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Desktop.log

MD5 8f96f336a858baecdad540d7057632ab
SHA1 837ef1971226f6800d726f20e058e72a2ec5ac05
SHA256 fda31e990bda2cccf53d7d0ccfa83ffb7e67fa96168cc1c2d7ad13f72d60854a
SHA512 b885f0c45e40d4b99336b82bb670b0826ad73a2b610d93e4ecd83f6d9de0098b5b2fd5cf43bd05330ef11d6c02ceb2745596b38cfddea634984f0c929d6b422a

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\info.log

MD5 85322fd0dc0c71cc8c2bcfcc2de8a313
SHA1 4a5bbe99bd0f491bfdad544d842d6281e8c26d40
SHA256 f41be54336db96b30d87d669498ffb91b39dd823c1abe2d645e6f0008467ff25
SHA512 64df0ef2c5241e531ccc9d066fac54447d26cb65d766385bda914a8259bb374ee536355a61b1ce7a38ebbd8e72313268aa3a4aefa415b21062bd2d85f54b1513

memory/680-348-0x0000000000720000-0x0000000000760000-memory.dmp

memory/4516-355-0x0000000000750000-0x0000000000790000-memory.dmp

memory/3732-361-0x00000000005F0000-0x0000000000600000-memory.dmp

memory/3732-362-0x0000000000A40000-0x0000000000A80000-memory.dmp

memory/1100-382-0x0000000000730000-0x0000000000740000-memory.dmp

memory/1100-383-0x0000000000740000-0x0000000000780000-memory.dmp

memory/2252-397-0x0000000000710000-0x0000000000750000-memory.dmp

C:\Program Files\WinNexus\Desktop\bin\WinNexusLog\Action.log

MD5 13ba1bb4cb027d46f922b498846c3ebf
SHA1 4871ec5bbf7982949bb6354bfcf88d9cfc90b0dc
SHA256 d06963a31929945fe294f656e65f3599c95db53685039e5bba21dba5ef41e464
SHA512 5850fedfd1be45c0b35353dff8160d2967cb5af0e945a5a55423f9e21821c296c62d730c0fb7c099893f3998b6ba92506d1829077d974dce0dd7356e6c2d4497

memory/1980-403-0x00000000006C0000-0x00000000006D0000-memory.dmp

memory/2984-418-0x0000000000B90000-0x0000000000BD0000-memory.dmp