Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 10:05
Static task
static1
Behavioral task
behavioral1
Sample
a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe
-
Size
211KB
-
MD5
a21f61fc9870af66d5cbeb8578fcb57d
-
SHA1
09144ec09f6e92a5c918cf2153c72c011d0855e4
-
SHA256
c949b846121b17c66e65b196e24872ba117861dfe41a491e3ee361d26092eec0
-
SHA512
964563f97753e8e5568dad77b85258ce2eee57f4820070c009da54e7d983809646beaf39c0161883207cf6f09a9eb28176fcb7c3fb277daee43e5c7b7fbc9472
-
SSDEEP
3072:bmHPiWYu4h+O+Dg1F7Y0qSZLalC59pb33xjqVbTBtlyAjH:b4TYu6+OzZlaA59p9GVptlyS
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (77) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 2 IoCs
flow pid Process 47 1636 Process not Found 49 1636 Process not Found -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation IOQUgoYc.exe -
Executes dropped EXE 2 IoCs
pid Process 3636 IOQUgoYc.exe 1064 NOQIkIIs.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NOQIkIIs.exe = "C:\\ProgramData\\zssIAokI\\NOQIkIIs.exe" a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IOQUgoYc.exe = "C:\\Users\\Admin\\gAUUcIUY\\IOQUgoYc.exe" IOQUgoYc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NOQIkIIs.exe = "C:\\ProgramData\\zssIAokI\\NOQIkIIs.exe" NOQIkIIs.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IOQUgoYc.exe = "C:\\Users\\Admin\\gAUUcIUY\\IOQUgoYc.exe" a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe IOQUgoYc.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe IOQUgoYc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOQUgoYc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 5068 reg.exe 1444 reg.exe 2416 Process not Found 448 reg.exe 456 reg.exe 60 reg.exe 1336 reg.exe 1548 reg.exe 4492 reg.exe 1684 reg.exe 3580 reg.exe 3684 reg.exe 4996 reg.exe 3208 reg.exe 4636 reg.exe 964 reg.exe 4860 reg.exe 4792 reg.exe 1052 reg.exe 368 reg.exe 1480 reg.exe 3812 reg.exe 2416 reg.exe 3868 reg.exe 1940 reg.exe 3012 reg.exe 452 reg.exe 4460 Process not Found 2816 reg.exe 2384 reg.exe 1608 reg.exe 536 Process not Found 4456 reg.exe 692 reg.exe 3576 reg.exe 728 reg.exe 3036 reg.exe 4868 reg.exe 2844 reg.exe 4816 reg.exe 4400 reg.exe 3192 Process not Found 2068 reg.exe 4076 reg.exe 2248 reg.exe 3132 reg.exe 4424 reg.exe 2384 reg.exe 3332 reg.exe 368 reg.exe 2716 reg.exe 2556 reg.exe 3880 reg.exe 772 reg.exe 3492 reg.exe 4480 reg.exe 4532 reg.exe 4724 reg.exe 4300 Process not Found 540 reg.exe 1436 reg.exe 1632 reg.exe 3204 reg.exe 536 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1992 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1992 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1992 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1992 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1940 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1940 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1940 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1940 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 800 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 800 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 800 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 800 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3492 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3492 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3492 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3492 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 5016 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 5016 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 5016 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 5016 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 2524 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 2524 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 2524 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 2524 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3372 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3372 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3372 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3372 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1692 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1692 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1692 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1692 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 2520 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 2520 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 2520 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 2520 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 5044 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 5044 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 5044 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 5044 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3592 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3592 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3592 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 3592 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 4268 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 4268 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 4268 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 4268 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1996 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1996 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1996 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 1996 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3636 IOQUgoYc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe 3636 IOQUgoYc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4756 wrote to memory of 3636 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 87 PID 4756 wrote to memory of 3636 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 87 PID 4756 wrote to memory of 3636 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 87 PID 4756 wrote to memory of 1064 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 88 PID 4756 wrote to memory of 1064 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 88 PID 4756 wrote to memory of 1064 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 88 PID 4756 wrote to memory of 1948 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 89 PID 4756 wrote to memory of 1948 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 89 PID 4756 wrote to memory of 1948 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 89 PID 1948 wrote to memory of 3076 1948 cmd.exe 91 PID 1948 wrote to memory of 3076 1948 cmd.exe 91 PID 1948 wrote to memory of 3076 1948 cmd.exe 91 PID 4756 wrote to memory of 448 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 92 PID 4756 wrote to memory of 448 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 92 PID 4756 wrote to memory of 448 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 92 PID 4756 wrote to memory of 2068 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 93 PID 4756 wrote to memory of 2068 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 93 PID 4756 wrote to memory of 2068 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 93 PID 4756 wrote to memory of 3700 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 94 PID 4756 wrote to memory of 3700 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 94 PID 4756 wrote to memory of 3700 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 94 PID 4756 wrote to memory of 1564 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 95 PID 4756 wrote to memory of 1564 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 95 PID 4756 wrote to memory of 1564 4756 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 95 PID 1564 wrote to memory of 2512 1564 cmd.exe 100 PID 1564 wrote to memory of 2512 1564 cmd.exe 100 PID 1564 wrote to memory of 2512 1564 cmd.exe 100 PID 3076 wrote to memory of 4636 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 101 PID 3076 wrote to memory of 4636 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 101 PID 3076 wrote to memory of 4636 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 101 PID 4636 wrote to memory of 3760 4636 cmd.exe 103 PID 4636 wrote to memory of 3760 4636 cmd.exe 103 PID 4636 wrote to memory of 3760 4636 cmd.exe 103 PID 3076 wrote to memory of 960 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 104 PID 3076 wrote to memory of 960 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 104 PID 3076 wrote to memory of 960 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 104 PID 3076 wrote to memory of 1784 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 105 PID 3076 wrote to memory of 1784 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 105 PID 3076 wrote to memory of 1784 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 105 PID 3076 wrote to memory of 4428 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 106 PID 3076 wrote to memory of 4428 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 106 PID 3076 wrote to memory of 4428 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 106 PID 3076 wrote to memory of 1316 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 107 PID 3076 wrote to memory of 1316 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 107 PID 3076 wrote to memory of 1316 3076 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 107 PID 1316 wrote to memory of 3192 1316 cmd.exe 112 PID 1316 wrote to memory of 3192 1316 cmd.exe 112 PID 1316 wrote to memory of 3192 1316 cmd.exe 112 PID 3760 wrote to memory of 1160 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 113 PID 3760 wrote to memory of 1160 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 113 PID 3760 wrote to memory of 1160 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 113 PID 1160 wrote to memory of 1992 1160 cmd.exe 115 PID 1160 wrote to memory of 1992 1160 cmd.exe 115 PID 1160 wrote to memory of 1992 1160 cmd.exe 115 PID 3760 wrote to memory of 4084 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 116 PID 3760 wrote to memory of 4084 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 116 PID 3760 wrote to memory of 4084 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 116 PID 3760 wrote to memory of 5116 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 117 PID 3760 wrote to memory of 5116 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 117 PID 3760 wrote to memory of 5116 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 117 PID 3760 wrote to memory of 4076 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 118 PID 3760 wrote to memory of 4076 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 118 PID 3760 wrote to memory of 4076 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 118 PID 3760 wrote to memory of 2820 3760 a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\gAUUcIUY\IOQUgoYc.exe"C:\Users\Admin\gAUUcIUY\IOQUgoYc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3636
-
-
C:\ProgramData\zssIAokI\NOQIkIIs.exe"C:\ProgramData\zssIAokI\NOQIkIIs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1064
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"2⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes1183⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"4⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes1185⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"6⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes1187⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"8⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes1189⤵
- Suspicious behavior: EnumeratesProcesses
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"10⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11811⤵
- Suspicious behavior: EnumeratesProcesses
PID:800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"12⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11813⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"14⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11815⤵
- Suspicious behavior: EnumeratesProcesses
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"16⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11817⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"18⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11819⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"20⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11821⤵
- Suspicious behavior: EnumeratesProcesses
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"22⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11823⤵
- Suspicious behavior: EnumeratesProcesses
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"24⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11825⤵
- Suspicious behavior: EnumeratesProcesses
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"26⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11827⤵
- Suspicious behavior: EnumeratesProcesses
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"28⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11829⤵
- Suspicious behavior: EnumeratesProcesses
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"30⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11831⤵
- Suspicious behavior: EnumeratesProcesses
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"32⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11833⤵PID:868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"34⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11835⤵PID:3868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"36⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11837⤵PID:4696
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"38⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11839⤵PID:2788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"40⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11841⤵PID:3192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"42⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11843⤵PID:1592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"44⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11845⤵PID:3904
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"46⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11847⤵PID:1340
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"48⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11849⤵PID:540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"50⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11851⤵PID:348
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"52⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11853⤵PID:884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"54⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11855⤵PID:5016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"56⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11857⤵PID:1812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"58⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11859⤵PID:720
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"60⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11861⤵PID:4932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"62⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11863⤵PID:800
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"64⤵
- System Location Discovery: System Language Discovery
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11865⤵PID:4808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"66⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11867⤵PID:3604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"68⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11869⤵PID:2252
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"70⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11871⤵PID:2840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"72⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11873⤵PID:1712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"74⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11875⤵PID:3224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"76⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11877⤵PID:1532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"78⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11879⤵PID:4268
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"80⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11881⤵PID:540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"82⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11883⤵PID:4732
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"84⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11885⤵PID:884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"86⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11887⤵PID:1160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"88⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11889⤵PID:2532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"90⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11891⤵PID:1592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"92⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11893⤵
- System Location Discovery: System Language Discovery
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"94⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11895⤵PID:2784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"96⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11897⤵PID:1616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"98⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes11899⤵PID:3236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"100⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118101⤵PID:3024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"102⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118103⤵PID:4004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"104⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118105⤵PID:4988
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"106⤵
- System Location Discovery: System Language Discovery
PID:976 -
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118107⤵PID:3184
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"108⤵
- System Location Discovery: System Language Discovery
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118109⤵PID:5116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"110⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118111⤵PID:400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"112⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118113⤵PID:4168
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"114⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118115⤵PID:2472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"116⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118117⤵PID:1964
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"118⤵
- System Location Discovery: System Language Discovery
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118119⤵PID:4024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"120⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118121⤵PID:3116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a21f61fc9870af66d5cbeb8578fcb57d_JaffaCakes118"122⤵PID:1148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-