Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 00:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe
-
Size
264KB
-
MD5
61fca526f013a4daafad8d6a13ffdf12
-
SHA1
001bdfdb4f794803fe2851d30d9d6d437b9e4f6c
-
SHA256
6f7e7fdff1ab9280412e7b81d1b0377807780af22656c7cfd0db61b0b03debb6
-
SHA512
5a46aacfdfb3352db9d5cdd25fc1b7201ec86957eb9c5983d3e53b693f9e6d7fe28b475367ad13ea22b38e0694ebfeeb8ea44f89aaa5530ff12f77b260c70300
-
SSDEEP
6144:XCJ3GPtw3RS+BRHtw3RS+BREsoVcAaRJnqBVgtc:XOpiEskCJe
Malware Config
Signatures
-
Executes dropped EXE 11 IoCs
pid Process 3876 zaztamsn.exe 5848 zaztamsn.exe 7696 zaztamsn.exe 6660 zaztamsn.exe 7056 zaztamsn.exe 7432 zaztamsn.exe 5808 zaztamsn.exe 5716 zaztamsn.exe 1796 zaztamsn.exe 2148 zaztamsn.exe 3444 zaztamsn.exe -
Installs/modifies Browser Helper Object 2 TTPs 22 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544} 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544}\ = "yzztdmsn.dll" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544}\ = "yzztdmsn.dll" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544}\ = "yzztdmsn.dll" zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544} zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544} zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544} zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544} zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544}\ = "yzztdmsn.dll" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544}\ = "yzztdmsn.dll" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544}\ = "yzztdmsn.dll" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544}\ = "yzztdmsn.dll" 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544} zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544}\ = "yzztdmsn.dll" zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544} zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544} zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544}\ = "yzztdmsn.dll" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544}\ = "yzztdmsn.dll" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544}\ = "yzztdmsn.dll" zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544} zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544} zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4490415F-65F8-B5C5-D8BA-9405FB120544} zaztamsn.exe -
Drops file in System32 directory 59 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File created C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\zaztamsn.exe zaztamsn.exe File created C:\Windows\SysWOW64\zaztamsn.exe 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xfztamsn.sys zaztamsn.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe zaztamsn.exe File opened for modification C:\Windows\SysWOW64\xfztamsn.sys zaztamsn.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe zaztamsn.exe File opened for modification C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe zaztamsn.exe File created C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\xfztamsn.sys zaztamsn.exe File opened for modification C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\xfztamsn.sys zaztamsn.exe File created C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\xfztamsn.sys zaztamsn.exe File created C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\xfztamsn.sys zaztamsn.exe File opened for modification C:\Windows\SysWOW64\xfztamsn.sys zaztamsn.exe File opened for modification C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File created C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe zaztamsn.exe File opened for modification C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File created C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File created C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File created C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe zaztamsn.exe File opened for modification C:\Windows\SysWOW64\xfztamsn.sys zaztamsn.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe zaztamsn.exe File opened for modification C:\Windows\SysWOW64\zaztamsn.exe zaztamsn.exe File opened for modification C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\zaztamsn.exe 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xfztamsn.sys zaztamsn.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe zaztamsn.exe File created C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe zaztamsn.exe File opened for modification C:\Windows\SysWOW64\zaztamsn.exe zaztamsn.exe File opened for modification C:\Windows\SysWOW64\zaztamsn.exe zaztamsn.exe File opened for modification C:\Windows\SysWOW64\zaztamsn.exe zaztamsn.exe File opened for modification C:\Windows\SysWOW64\yzztdmsn.dll 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe File created C:\Windows\SysWOW64\yzztdmsn.dll 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe zaztamsn.exe File opened for modification C:\Windows\SysWOW64\zaztamsn.exe zaztamsn.exe File created C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\xfztamsn.sys 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\zaztamsn.exe zaztamsn.exe File opened for modification C:\Windows\SysWOW64\zaztamsn.exe zaztamsn.exe File opened for modification C:\Windows\SysWOW64\zaztamsn.exe zaztamsn.exe File opened for modification C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe zaztamsn.exe File created C:\Windows\SysWOW64\yzztdmsn.dll zaztamsn.exe File opened for modification C:\Windows\SysWOW64\xfztamsn.sys zaztamsn.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe zaztamsn.exe File opened for modification C:\Windows\SysWOW64\zaztamsn.exe zaztamsn.exe -
Modifies registry class 36 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ThreadingModel = "Apartment" zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32 zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ThreadingModel = "Apartment" 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ = "C:\\Windows\\SysWow64\\yzztdmsn.dll" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ThreadingModel = "Apartment" zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32 zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ThreadingModel = "Apartment" zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32 zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ThreadingModel = "Apartment" zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32 zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ = "C:\\Windows\\SysWow64\\yzztdmsn.dll" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ = "C:\\Windows\\SysWow64\\yzztdmsn.dll" zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32 zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32 zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ = "C:\\Windows\\SysWow64\\yzztdmsn.dll" zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544} 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ThreadingModel = "Apartment" zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32 zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ = "C:\\Windows\\SysWow64\\yzztdmsn.dll" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ThreadingModel = "Apartment" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ = "C:\\Windows\\SysWow64\\yzztdmsn.dll" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ = "C:\\Windows\\SysWow64\\yzztdmsn.dll" zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ = "C:\\Windows\\SysWow64\\yzztdmsn.dll" 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ = "C:\\Windows\\SysWow64\\yzztdmsn.dll" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ThreadingModel = "Apartment" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ThreadingModel = "Apartment" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ThreadingModel = "Apartment" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ = "C:\\Windows\\SysWow64\\yzztdmsn.dll" zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ThreadingModel = "Apartment" zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32 zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32 zaztamsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32\ = "C:\\Windows\\SysWow64\\yzztdmsn.dll" zaztamsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4490415F-65F8-B5C5-D8BA-9405FB120544}\InprocServer32 zaztamsn.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2340 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe 2340 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe 3876 zaztamsn.exe 3876 zaztamsn.exe 5848 zaztamsn.exe 5848 zaztamsn.exe 7696 zaztamsn.exe 7696 zaztamsn.exe 6660 zaztamsn.exe 6660 zaztamsn.exe 7056 zaztamsn.exe 7056 zaztamsn.exe 7432 zaztamsn.exe 7432 zaztamsn.exe 5808 zaztamsn.exe 5808 zaztamsn.exe 5716 zaztamsn.exe 5716 zaztamsn.exe 1796 zaztamsn.exe 1796 zaztamsn.exe 2148 zaztamsn.exe 2148 zaztamsn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2340 wrote to memory of 1136 2340 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe 84 PID 2340 wrote to memory of 1136 2340 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe 84 PID 2340 wrote to memory of 1136 2340 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe 84 PID 2340 wrote to memory of 3876 2340 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe 86 PID 2340 wrote to memory of 3876 2340 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe 86 PID 2340 wrote to memory of 3876 2340 61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe 86 PID 3876 wrote to memory of 1388 3876 zaztamsn.exe 87 PID 3876 wrote to memory of 1388 3876 zaztamsn.exe 87 PID 3876 wrote to memory of 1388 3876 zaztamsn.exe 87 PID 3876 wrote to memory of 5848 3876 zaztamsn.exe 89 PID 3876 wrote to memory of 5848 3876 zaztamsn.exe 89 PID 3876 wrote to memory of 5848 3876 zaztamsn.exe 89 PID 5848 wrote to memory of 1272 5848 zaztamsn.exe 90 PID 5848 wrote to memory of 1272 5848 zaztamsn.exe 90 PID 5848 wrote to memory of 1272 5848 zaztamsn.exe 90 PID 5848 wrote to memory of 7696 5848 zaztamsn.exe 92 PID 5848 wrote to memory of 7696 5848 zaztamsn.exe 92 PID 5848 wrote to memory of 7696 5848 zaztamsn.exe 92 PID 7696 wrote to memory of 7748 7696 zaztamsn.exe 93 PID 7696 wrote to memory of 7748 7696 zaztamsn.exe 93 PID 7696 wrote to memory of 7748 7696 zaztamsn.exe 93 PID 7696 wrote to memory of 6660 7696 zaztamsn.exe 95 PID 7696 wrote to memory of 6660 7696 zaztamsn.exe 95 PID 7696 wrote to memory of 6660 7696 zaztamsn.exe 95 PID 6660 wrote to memory of 6620 6660 zaztamsn.exe 96 PID 6660 wrote to memory of 6620 6660 zaztamsn.exe 96 PID 6660 wrote to memory of 6620 6660 zaztamsn.exe 96 PID 6660 wrote to memory of 7056 6660 zaztamsn.exe 97 PID 6660 wrote to memory of 7056 6660 zaztamsn.exe 97 PID 6660 wrote to memory of 7056 6660 zaztamsn.exe 97 PID 7056 wrote to memory of 6956 7056 zaztamsn.exe 99 PID 7056 wrote to memory of 6956 7056 zaztamsn.exe 99 PID 7056 wrote to memory of 6956 7056 zaztamsn.exe 99 PID 7056 wrote to memory of 7432 7056 zaztamsn.exe 101 PID 7056 wrote to memory of 7432 7056 zaztamsn.exe 101 PID 7056 wrote to memory of 7432 7056 zaztamsn.exe 101 PID 7432 wrote to memory of 7316 7432 zaztamsn.exe 102 PID 7432 wrote to memory of 7316 7432 zaztamsn.exe 102 PID 7432 wrote to memory of 7316 7432 zaztamsn.exe 102 PID 7432 wrote to memory of 5808 7432 zaztamsn.exe 104 PID 7432 wrote to memory of 5808 7432 zaztamsn.exe 104 PID 7432 wrote to memory of 5808 7432 zaztamsn.exe 104 PID 5808 wrote to memory of 5776 5808 zaztamsn.exe 105 PID 5808 wrote to memory of 5776 5808 zaztamsn.exe 105 PID 5808 wrote to memory of 5776 5808 zaztamsn.exe 105 PID 5808 wrote to memory of 5716 5808 zaztamsn.exe 107 PID 5808 wrote to memory of 5716 5808 zaztamsn.exe 107 PID 5808 wrote to memory of 5716 5808 zaztamsn.exe 107 PID 5716 wrote to memory of 5676 5716 zaztamsn.exe 108 PID 5716 wrote to memory of 5676 5716 zaztamsn.exe 108 PID 5716 wrote to memory of 5676 5716 zaztamsn.exe 108 PID 5716 wrote to memory of 1796 5716 zaztamsn.exe 109 PID 5716 wrote to memory of 1796 5716 zaztamsn.exe 109 PID 5716 wrote to memory of 1796 5716 zaztamsn.exe 109 PID 1796 wrote to memory of 1424 1796 zaztamsn.exe 111 PID 1796 wrote to memory of 1424 1796 zaztamsn.exe 111 PID 1796 wrote to memory of 1424 1796 zaztamsn.exe 111 PID 1796 wrote to memory of 2148 1796 zaztamsn.exe 471 PID 1796 wrote to memory of 2148 1796 zaztamsn.exe 471 PID 1796 wrote to memory of 2148 1796 zaztamsn.exe 471 PID 2148 wrote to memory of 3940 2148 zaztamsn.exe 114 PID 2148 wrote to memory of 3940 2148 zaztamsn.exe 114 PID 2148 wrote to memory of 3940 2148 zaztamsn.exe 114 PID 2148 wrote to memory of 3444 2148 zaztamsn.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\61fca526f013a4daafad8d6a13ffdf12_JaffaCakes118.exe"1⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240611593.bat2⤵PID:1136
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe2⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240611921.bat3⤵PID:1388
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe3⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240612218.bat4⤵PID:1272
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe4⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:7696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240612531.bat5⤵PID:7748
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe5⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240612828.bat6⤵PID:6620
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe6⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:7056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240613078.bat7⤵PID:6956
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe7⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:7432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240613359.bat8⤵PID:7316
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe8⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240613578.bat9⤵PID:5776
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe9⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240613843.bat10⤵PID:5676
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe10⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240614109.bat11⤵PID:1424
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe11⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240614390.bat12⤵PID:3940
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240614718.bat13⤵PID:6740
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe13⤵PID:7332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240615000.bat14⤵PID:7492
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe14⤵PID:3872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240615343.bat15⤵PID:5348
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe15⤵PID:8276
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240615625.bat16⤵PID:8308
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe16⤵PID:5604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240615890.bat17⤵PID:5616
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe17⤵PID:7152
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240616156.bat18⤵PID:5880
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe18⤵PID:8136
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240616390.bat19⤵PID:5436
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe19⤵PID:4844
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240617093.bat20⤵PID:7836
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe20⤵PID:7372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240617359.bat21⤵PID:8512
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe21⤵PID:2376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240617640.bat22⤵PID:8828
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe22⤵PID:5488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240617953.bat23⤵PID:7972
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe23⤵PID:2472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240618375.bat24⤵PID:3992
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe24⤵PID:6336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240618625.bat25⤵PID:8172
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe25⤵PID:6780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240618937.bat26⤵PID:1932
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe26⤵PID:2920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240619156.bat27⤵PID:4200
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe27⤵PID:6580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240619437.bat28⤵PID:7648
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe28⤵PID:6812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240619796.bat29⤵PID:7912
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe29⤵PID:7668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240620093.bat30⤵PID:5648
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe30⤵PID:8580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240620421.bat31⤵PID:8660
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe31⤵PID:7132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240620703.bat32⤵PID:3152
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe32⤵PID:7580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240620968.bat33⤵PID:3608
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe33⤵PID:1532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621265.bat34⤵PID:8060
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe34⤵PID:1372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621500.bat35⤵PID:6508
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe35⤵PID:7540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621750.bat36⤵PID:1404
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe36⤵PID:8708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621968.bat37⤵PID:6708
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe37⤵PID:7660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240622218.bat38⤵PID:6252
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe38⤵PID:9924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240622531.bat39⤵PID:9952
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe39⤵PID:9200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240622828.bat40⤵PID:4836
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe40⤵PID:7320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623062.bat41⤵PID:7532
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe41⤵PID:1744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623312.bat42⤵PID:8796
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe42⤵PID:9212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623515.bat43⤵PID:9572
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe43⤵PID:5680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623765.bat44⤵PID:7560
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe44⤵PID:8676
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624015.bat45⤵PID:6096
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe45⤵PID:9152
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624328.bat46⤵PID:1192
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe46⤵PID:7848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624625.bat47⤵PID:8932
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe47⤵PID:9452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624859.bat48⤵PID:7076
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe48⤵PID:3968
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625171.bat49⤵PID:7884
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe49⤵PID:8380
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625515.bat50⤵PID:4328
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe50⤵PID:6716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625781.bat51⤵PID:9256
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe51⤵PID:9168
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626078.bat52⤵PID:10084
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe52⤵PID:8128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626453.bat53⤵PID:1484
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe53⤵PID:9736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626796.bat54⤵PID:8484
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe54⤵PID:880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627078.bat55⤵PID:2824
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe55⤵PID:5008
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627312.bat56⤵PID:908
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe56⤵PID:7264
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627640.bat57⤵PID:5156
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe57⤵PID:6804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240628093.bat58⤵PID:9104
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe58⤵PID:10560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240628421.bat59⤵PID:10596
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe59⤵PID:1916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240628562.bat60⤵PID:7684
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe60⤵PID:6936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240628906.bat61⤵PID:8468
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe61⤵PID:11752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629156.bat62⤵PID:11800
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe62⤵PID:10420
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629375.bat63⤵PID:3112
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe63⤵PID:10708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629671.bat64⤵PID:7956
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe64⤵PID:9392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629906.bat65⤵PID:10052
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe65⤵PID:11484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630250.bat66⤵PID:11528
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe66⤵PID:10816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630531.bat67⤵PID:7864
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe67⤵PID:9840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630812.bat68⤵PID:4524
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe68⤵PID:8884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631171.bat69⤵PID:6572
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe69⤵PID:1080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631468.bat70⤵PID:3632
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe70⤵PID:5492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631703.bat71⤵PID:3464
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe71⤵PID:11360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631984.bat72⤵PID:11268
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe72⤵PID:1260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632218.bat73⤵PID:6724
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe73⤵PID:2652
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632484.bat74⤵PID:8524
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe74⤵PID:6876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633109.bat75⤵PID:11688
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe75⤵PID:3168
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633359.bat76⤵PID:4788
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe76⤵PID:7804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633640.bat77⤵PID:9164
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe77⤵PID:10092
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633890.bat78⤵PID:10524
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe78⤵PID:8440
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634062.bat79⤵PID:1728
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe79⤵PID:7280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634281.bat80⤵PID:11480
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe80⤵PID:6776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634640.bat81⤵PID:8460
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe81⤵PID:8064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634937.bat82⤵PID:6296
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe82⤵PID:2908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635218.bat83⤵PID:6916
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe83⤵PID:11164
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635500.bat84⤵PID:11432
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe84⤵PID:7412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635859.bat85⤵PID:11900
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe85⤵PID:11212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636140.bat86⤵PID:10844
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe86⤵PID:5400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636437.bat87⤵PID:6492
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe87⤵PID:5320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636640.bat88⤵PID:11616
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe88⤵PID:11852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636906.bat89⤵PID:9548
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe89⤵PID:2544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637156.bat90⤵PID:12072
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe90⤵PID:13044
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637437.bat91⤵PID:13080
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe91⤵PID:8652
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637703.bat92⤵PID:4512
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe92⤵PID:9812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638000.bat93⤵PID:6576
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe93⤵PID:6828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638265.bat94⤵PID:9904
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe94⤵PID:2176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638468.bat95⤵PID:7920
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe95⤵PID:7644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638765.bat96⤵PID:3496
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe96⤵PID:13812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639031.bat97⤵PID:13872
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe97⤵PID:11328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639328.bat98⤵PID:12456
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe98⤵PID:9120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639656.bat99⤵PID:12112
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe99⤵PID:1884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639890.bat100⤵PID:14184
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe100⤵PID:13416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640125.bat101⤵PID:13452
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe101⤵PID:12560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640406.bat102⤵PID:13176
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe102⤵PID:12444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640734.bat103⤵PID:12364
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe103⤵PID:8352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641031.bat104⤵PID:12224
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe104⤵PID:13868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641390.bat105⤵PID:9880
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe105⤵PID:10896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641671.bat106⤵PID:12752
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe106⤵PID:5316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642078.bat107⤵PID:12272
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe107⤵PID:10088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642328.bat108⤵PID:8732
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe108⤵PID:1596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642625.bat109⤵PID:6848
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe109⤵PID:14128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642921.bat110⤵PID:8700
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe110⤵PID:6316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643250.bat111⤵PID:13528
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe111⤵PID:12912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643609.bat112⤵PID:9728
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe112⤵PID:14224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643921.bat113⤵PID:11460
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe113⤵PID:7784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644265.bat114⤵PID:4040
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe114⤵PID:11384
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644593.bat115⤵PID:12244
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe115⤵PID:9788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644812.bat116⤵PID:4332
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe116⤵PID:1584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240645046.bat117⤵PID:12108
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe117⤵PID:8052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240645484.bat118⤵PID:14076
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe118⤵PID:13296
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240645718.bat119⤵PID:6736
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe119⤵PID:9872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646062.bat120⤵PID:6564
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe120⤵PID:12656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646343.bat121⤵PID:2104
-
-
C:\Windows\SysWOW64\zaztamsn.exeC:\Windows\system32\zaztamsn.exe121⤵PID:15028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646640.bat122⤵PID:14624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-