Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 03:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d368799253f0ddc8abff975cdd5cb662_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
d368799253f0ddc8abff975cdd5cb662_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
d368799253f0ddc8abff975cdd5cb662_JaffaCakes118.exe
-
Size
52KB
-
MD5
d368799253f0ddc8abff975cdd5cb662
-
SHA1
1c6955f11d4bc1df51e068864a47bc3db925e474
-
SHA256
61cf8b8494c65b218fac93823906a2d4bb20d243389eaf5c6f4965de6a5de27d
-
SHA512
ac81e879345c11dbbf3fc22ae0a1f29070be0e680c329f435da9562b4438e3d5ba558b8ba9e9427a6b94e4bce1e2beb569498fb3cd35dcc171aeddf27ef694ec
-
SSDEEP
1536:Wv8r7b0OuAnlC9YiR2xZML2EoeACnJ278QGmldqvHg4Wv+Uy0DQS02hZs:Wv8r71nlC9YiR2xZML2deACnJ278QGmG
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 652 UpdReg.exe 2592 UpdReg.exe 892 UpdReg.exe 1828 UpdReg.exe 3924 UpdReg.exe 4128 UpdReg.exe 2796 UpdReg.exe 1136 UpdReg.exe 2264 UpdReg.exe 860 UpdReg.exe 4904 UpdReg.exe 4248 UpdReg.exe 2776 UpdReg.exe 5116 UpdReg.exe 3128 UpdReg.exe 4964 UpdReg.exe 3220 UpdReg.exe 2240 UpdReg.exe 4420 UpdReg.exe 960 UpdReg.exe 1356 UpdReg.exe 2040 UpdReg.exe 4584 UpdReg.exe 4476 UpdReg.exe 3968 UpdReg.exe 3876 UpdReg.exe 2748 UpdReg.exe 2312 UpdReg.exe 4824 UpdReg.exe 4268 UpdReg.exe 5000 UpdReg.exe 4632 UpdReg.exe 1820 UpdReg.exe 2268 UpdReg.exe 1724 UpdReg.exe 2716 UpdReg.exe 4440 UpdReg.exe 4504 UpdReg.exe 5108 UpdReg.exe 4300 UpdReg.exe 1696 UpdReg.exe 3212 UpdReg.exe 5064 UpdReg.exe 4696 UpdReg.exe 928 UpdReg.exe 5080 UpdReg.exe 4116 UpdReg.exe 692 UpdReg.exe 3340 UpdReg.exe 3928 UpdReg.exe 1540 UpdReg.exe 3244 UpdReg.exe 4148 UpdReg.exe 1432 UpdReg.exe 100 UpdReg.exe 5036 UpdReg.exe 2136 UpdReg.exe 2792 UpdReg.exe 2692 UpdReg.exe 716 UpdReg.exe 3432 UpdReg.exe 4000 UpdReg.exe 3656 UpdReg.exe 3532 UpdReg.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" UpdReg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" UpdReg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" UpdReg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" UpdReg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" UpdReg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" UpdReg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" UpdReg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" UpdReg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" UpdReg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" UpdReg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" UpdReg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" UpdReg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateReg = "UpdReg.exe" UpdReg.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe UpdReg.exe File created C:\Windows\SysWOW64\UpdReg.exe UpdReg.exe File created C:\Windows\SysWOW64\UpdReg.exe UpdReg.exe File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe UpdReg.exe File created C:\Windows\SysWOW64\UpdReg.exe UpdReg.exe File created C:\Windows\SysWOW64\UpdReg.exe UpdReg.exe File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe UpdReg.exe File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe UpdReg.exe File created C:\Windows\SysWOW64\UpdReg.exe UpdReg.exe File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe UpdReg.exe File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe UpdReg.exe File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe Process not Found File created C:\Windows\SysWOW64\UpdReg.exe UpdReg.exe File created C:\Windows\SysWOW64\UpdReg.exe Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UpdReg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UpdReg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UpdReg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UpdReg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UpdReg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UpdReg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UpdReg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UpdReg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UpdReg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UpdReg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 632 wrote to memory of 652 632 d368799253f0ddc8abff975cdd5cb662_JaffaCakes118.exe 83 PID 632 wrote to memory of 652 632 d368799253f0ddc8abff975cdd5cb662_JaffaCakes118.exe 83 PID 632 wrote to memory of 652 632 d368799253f0ddc8abff975cdd5cb662_JaffaCakes118.exe 83 PID 652 wrote to memory of 2592 652 UpdReg.exe 84 PID 652 wrote to memory of 2592 652 UpdReg.exe 84 PID 652 wrote to memory of 2592 652 UpdReg.exe 84 PID 2592 wrote to memory of 892 2592 UpdReg.exe 85 PID 2592 wrote to memory of 892 2592 UpdReg.exe 85 PID 2592 wrote to memory of 892 2592 UpdReg.exe 85 PID 892 wrote to memory of 1828 892 UpdReg.exe 86 PID 892 wrote to memory of 1828 892 UpdReg.exe 86 PID 892 wrote to memory of 1828 892 UpdReg.exe 86 PID 1828 wrote to memory of 3924 1828 UpdReg.exe 87 PID 1828 wrote to memory of 3924 1828 UpdReg.exe 87 PID 1828 wrote to memory of 3924 1828 UpdReg.exe 87 PID 3924 wrote to memory of 4128 3924 UpdReg.exe 88 PID 3924 wrote to memory of 4128 3924 UpdReg.exe 88 PID 3924 wrote to memory of 4128 3924 UpdReg.exe 88 PID 4128 wrote to memory of 2796 4128 UpdReg.exe 89 PID 4128 wrote to memory of 2796 4128 UpdReg.exe 89 PID 4128 wrote to memory of 2796 4128 UpdReg.exe 89 PID 2796 wrote to memory of 1136 2796 UpdReg.exe 90 PID 2796 wrote to memory of 1136 2796 UpdReg.exe 90 PID 2796 wrote to memory of 1136 2796 UpdReg.exe 90 PID 1136 wrote to memory of 2264 1136 UpdReg.exe 91 PID 1136 wrote to memory of 2264 1136 UpdReg.exe 91 PID 1136 wrote to memory of 2264 1136 UpdReg.exe 91 PID 2264 wrote to memory of 860 2264 UpdReg.exe 92 PID 2264 wrote to memory of 860 2264 UpdReg.exe 92 PID 2264 wrote to memory of 860 2264 UpdReg.exe 92 PID 860 wrote to memory of 4904 860 UpdReg.exe 93 PID 860 wrote to memory of 4904 860 UpdReg.exe 93 PID 860 wrote to memory of 4904 860 UpdReg.exe 93 PID 4904 wrote to memory of 4248 4904 UpdReg.exe 94 PID 4904 wrote to memory of 4248 4904 UpdReg.exe 94 PID 4904 wrote to memory of 4248 4904 UpdReg.exe 94 PID 4248 wrote to memory of 2776 4248 UpdReg.exe 95 PID 4248 wrote to memory of 2776 4248 UpdReg.exe 95 PID 4248 wrote to memory of 2776 4248 UpdReg.exe 95 PID 2776 wrote to memory of 5116 2776 UpdReg.exe 96 PID 2776 wrote to memory of 5116 2776 UpdReg.exe 96 PID 2776 wrote to memory of 5116 2776 UpdReg.exe 96 PID 5116 wrote to memory of 3128 5116 UpdReg.exe 97 PID 5116 wrote to memory of 3128 5116 UpdReg.exe 97 PID 5116 wrote to memory of 3128 5116 UpdReg.exe 97 PID 3128 wrote to memory of 4964 3128 UpdReg.exe 98 PID 3128 wrote to memory of 4964 3128 UpdReg.exe 98 PID 3128 wrote to memory of 4964 3128 UpdReg.exe 98 PID 4964 wrote to memory of 3220 4964 UpdReg.exe 99 PID 4964 wrote to memory of 3220 4964 UpdReg.exe 99 PID 4964 wrote to memory of 3220 4964 UpdReg.exe 99 PID 3220 wrote to memory of 2240 3220 UpdReg.exe 100 PID 3220 wrote to memory of 2240 3220 UpdReg.exe 100 PID 3220 wrote to memory of 2240 3220 UpdReg.exe 100 PID 2240 wrote to memory of 4420 2240 UpdReg.exe 101 PID 2240 wrote to memory of 4420 2240 UpdReg.exe 101 PID 2240 wrote to memory of 4420 2240 UpdReg.exe 101 PID 4420 wrote to memory of 960 4420 UpdReg.exe 102 PID 4420 wrote to memory of 960 4420 UpdReg.exe 102 PID 4420 wrote to memory of 960 4420 UpdReg.exe 102 PID 960 wrote to memory of 1356 960 UpdReg.exe 103 PID 960 wrote to memory of 1356 960 UpdReg.exe 103 PID 960 wrote to memory of 1356 960 UpdReg.exe 103 PID 1356 wrote to memory of 2040 1356 UpdReg.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d368799253f0ddc8abff975cdd5cb662_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d368799253f0ddc8abff975cdd5cb662_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe23⤵
- Executes dropped EXE
PID:2040 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe24⤵
- Executes dropped EXE
PID:4584 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe25⤵
- Executes dropped EXE
PID:4476 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe26⤵
- Executes dropped EXE
PID:3968 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe27⤵
- Executes dropped EXE
PID:3876 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe28⤵
- Executes dropped EXE
PID:2748 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe29⤵
- Executes dropped EXE
PID:2312 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe30⤵
- Executes dropped EXE
PID:4824 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe31⤵
- Executes dropped EXE
PID:4268 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe32⤵
- Executes dropped EXE
PID:5000 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe33⤵
- Executes dropped EXE
PID:4632 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe34⤵
- Executes dropped EXE
PID:1820 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe35⤵
- Executes dropped EXE
PID:2268 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe36⤵
- Executes dropped EXE
PID:1724 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe37⤵
- Executes dropped EXE
PID:2716 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe38⤵
- Executes dropped EXE
PID:4440 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe39⤵
- Executes dropped EXE
PID:4504 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe40⤵
- Executes dropped EXE
PID:5108 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe41⤵
- Executes dropped EXE
PID:4300 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe42⤵
- Executes dropped EXE
PID:1696 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe43⤵
- Executes dropped EXE
PID:3212 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe44⤵
- Executes dropped EXE
PID:5064 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe45⤵
- Executes dropped EXE
PID:4696 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:928 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe47⤵
- Executes dropped EXE
PID:5080 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe48⤵
- Executes dropped EXE
PID:4116 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe49⤵
- Executes dropped EXE
PID:692 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe50⤵
- Executes dropped EXE
PID:3340 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe51⤵
- Executes dropped EXE
PID:3928 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe52⤵
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe53⤵
- Executes dropped EXE
PID:3244 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe54⤵
- Executes dropped EXE
PID:4148 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe55⤵
- Executes dropped EXE
PID:1432 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe56⤵
- Executes dropped EXE
PID:100 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe57⤵
- Executes dropped EXE
PID:5036 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe58⤵
- Executes dropped EXE
PID:2136 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe59⤵
- Executes dropped EXE
PID:2792 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe60⤵
- Executes dropped EXE
PID:2692 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe61⤵
- Executes dropped EXE
PID:716 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe62⤵
- Executes dropped EXE
PID:3432 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe63⤵
- Executes dropped EXE
PID:4000 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe64⤵
- Executes dropped EXE
PID:3656 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe65⤵
- Executes dropped EXE
PID:3532 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe66⤵PID:800
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe67⤵PID:4444
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe68⤵PID:228
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe69⤵PID:316
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe70⤵PID:3412
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe71⤵PID:4836
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe72⤵PID:3392
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe73⤵PID:2016
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe74⤵PID:2680
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe75⤵
- Drops file in System32 directory
PID:1568 -
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe76⤵PID:3608
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe77⤵PID:2180
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe78⤵PID:3552
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe79⤵PID:2840
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe80⤵PID:2368
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe81⤵PID:1376
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe82⤵PID:4396
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe83⤵PID:1800
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe84⤵PID:5032
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe85⤵PID:2220
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe86⤵PID:1500
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe87⤵PID:3684
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe88⤵PID:3152
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe89⤵PID:4896
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe90⤵PID:4364
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe91⤵PID:2700
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe92⤵PID:5128
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe93⤵PID:5144
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe94⤵PID:5160
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe95⤵PID:5176
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe96⤵PID:5192
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe97⤵PID:5208
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe98⤵PID:5224
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe99⤵PID:5248
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe100⤵PID:5260
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe101⤵PID:5280
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe102⤵PID:5300
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe103⤵PID:5320
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe104⤵PID:5344
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe105⤵PID:5360
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe106⤵PID:5372
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe107⤵PID:5388
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe108⤵PID:5404
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe109⤵PID:5424
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe110⤵PID:5440
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe111⤵PID:5460
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe112⤵PID:5476
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe113⤵PID:5492
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe114⤵PID:5520
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe115⤵PID:5536
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe116⤵PID:5552
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe117⤵PID:5568
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe118⤵PID:5584
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe119⤵PID:5608
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe120⤵PID:5640
-
C:\Windows\SysWOW64\UpdReg.exeC:\Windows\system32\UpdReg.exe121⤵PID:5676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-