Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 04:20
Static task
static1
Behavioral task
behavioral1
Sample
d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe
-
Size
744KB
-
MD5
d999e95e47e14ed78bcf82903f5066e4
-
SHA1
dbced72e51a1d77e0bfea0920bc046ae24d211e3
-
SHA256
5ace2068d59ec186031434b1290a6341d0b237625caefebfefda792797d456bd
-
SHA512
c83bba4a38335242ffff6ea2ef95ef23cd63877dd987a8a48ddc6a586109aac61d1e164ce38cad954ec4f9e2c4a7569073a232d201caec96796d6432d7f4acd3
-
SSDEEP
12288:bVnxHTYOsbT6mPxKJekjyVgo5YYBKKSJQ1og9W5/cxdScCabuYyXi:9hTYqGK0KugjYBKlgW54iY/
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C58ADD1-6FF5-11EF-8EF2-FE6EB537C9A6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34F6AA11-6FF5-11EF-8EF2-FE6EB537C9A6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34AA7E11-6FF5-11EF-8EF2-FE6EB537C9A6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2808 iexplore.exe 2080 iexplore.exe 2568 iexplore.exe 2556 iexplore.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2568 iexplore.exe 2568 iexplore.exe 2808 iexplore.exe 2808 iexplore.exe 2080 iexplore.exe 2080 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 2556 iexplore.exe 2556 iexplore.exe 2480 iexplore.exe 2480 iexplore.exe 2804 iexplore.exe 2804 iexplore.exe 2644 iexplore.exe 2644 iexplore.exe 1448 iexplore.exe 1448 iexplore.exe 1052 iexplore.exe 1052 iexplore.exe 2760 iexplore.exe 2760 iexplore.exe 1796 iexplore.exe 1796 iexplore.exe 832 IEXPLORE.EXE 832 IEXPLORE.EXE 1516 IEXPLORE.EXE 1516 IEXPLORE.EXE 544 IEXPLORE.EXE 544 IEXPLORE.EXE 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE 832 IEXPLORE.EXE 832 IEXPLORE.EXE 3800 iexplore.exe 3800 iexplore.exe 4004 iexplore.exe 4004 iexplore.exe 4044 iexplore.exe 4044 iexplore.exe 3232 iexplore.exe 3232 iexplore.exe 3136 iexplore.exe 3136 iexplore.exe 3184 iexplore.exe 3184 iexplore.exe 3320 iexplore.exe 3320 iexplore.exe 832 IEXPLORE.EXE 832 IEXPLORE.EXE 1516 IEXPLORE.EXE 1516 IEXPLORE.EXE 832 IEXPLORE.EXE 832 IEXPLORE.EXE 1516 IEXPLORE.EXE 1516 IEXPLORE.EXE 1516 IEXPLORE.EXE 1516 IEXPLORE.EXE 544 IEXPLORE.EXE 544 IEXPLORE.EXE 3868 iexplore.exe 3868 iexplore.exe 2596 IEXPLORE.EXE 2596 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2640 3012 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 30 PID 3012 wrote to memory of 2640 3012 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 30 PID 3012 wrote to memory of 2640 3012 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 30 PID 3012 wrote to memory of 2760 3012 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 31 PID 3012 wrote to memory of 2760 3012 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 31 PID 3012 wrote to memory of 2760 3012 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2840 2640 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 32 PID 2640 wrote to memory of 2840 2640 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 32 PID 2640 wrote to memory of 2840 2640 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 32 PID 2640 wrote to memory of 2644 2640 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 33 PID 2640 wrote to memory of 2644 2640 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 33 PID 2640 wrote to memory of 2644 2640 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 33 PID 2840 wrote to memory of 2780 2840 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 34 PID 2840 wrote to memory of 2780 2840 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 34 PID 2840 wrote to memory of 2780 2840 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 34 PID 2780 wrote to memory of 2696 2780 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 35 PID 2780 wrote to memory of 2696 2780 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 35 PID 2780 wrote to memory of 2696 2780 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 35 PID 2840 wrote to memory of 2804 2840 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 36 PID 2840 wrote to memory of 2804 2840 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 36 PID 2840 wrote to memory of 2804 2840 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 36 PID 2780 wrote to memory of 2556 2780 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 37 PID 2780 wrote to memory of 2556 2780 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 37 PID 2780 wrote to memory of 2556 2780 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 37 PID 2696 wrote to memory of 2540 2696 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 38 PID 2696 wrote to memory of 2540 2696 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 38 PID 2696 wrote to memory of 2540 2696 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 38 PID 2540 wrote to memory of 2916 2540 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 40 PID 2540 wrote to memory of 2916 2540 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 40 PID 2540 wrote to memory of 2916 2540 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 40 PID 2696 wrote to memory of 2568 2696 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 39 PID 2696 wrote to memory of 2568 2696 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 39 PID 2696 wrote to memory of 2568 2696 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 39 PID 2540 wrote to memory of 2480 2540 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 41 PID 2540 wrote to memory of 2480 2540 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 41 PID 2540 wrote to memory of 2480 2540 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 41 PID 2916 wrote to memory of 836 2916 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 42 PID 2916 wrote to memory of 836 2916 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 42 PID 2916 wrote to memory of 836 2916 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 42 PID 2916 wrote to memory of 2080 2916 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 43 PID 2916 wrote to memory of 2080 2916 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 43 PID 2916 wrote to memory of 2080 2916 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 43 PID 836 wrote to memory of 2124 836 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 44 PID 836 wrote to memory of 2124 836 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 44 PID 836 wrote to memory of 2124 836 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 44 PID 836 wrote to memory of 2808 836 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 45 PID 836 wrote to memory of 2808 836 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 45 PID 836 wrote to memory of 2808 836 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 45 PID 2124 wrote to memory of 2580 2124 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 46 PID 2124 wrote to memory of 2580 2124 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 46 PID 2124 wrote to memory of 2580 2124 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 46 PID 2124 wrote to memory of 1084 2124 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 47 PID 2124 wrote to memory of 1084 2124 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 47 PID 2124 wrote to memory of 1084 2124 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 47 PID 2580 wrote to memory of 2152 2580 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 48 PID 2580 wrote to memory of 2152 2580 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 48 PID 2580 wrote to memory of 2152 2580 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 48 PID 2580 wrote to memory of 1448 2580 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 49 PID 2580 wrote to memory of 1448 2580 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 49 PID 2580 wrote to memory of 1448 2580 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 49 PID 2152 wrote to memory of 2356 2152 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 50 PID 2152 wrote to memory of 2356 2152 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 50 PID 2152 wrote to memory of 2356 2152 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 50 PID 2152 wrote to memory of 1052 2152 d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe 51 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe2⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe3⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe4⤵
- UAC bypass
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe5⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe6⤵
- UAC bypass
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe7⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe8⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:836 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe9⤵
- UAC bypass
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe10⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe11⤵
- UAC bypass
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe12⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe13⤵
- UAC bypass
- System policy modification
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe14⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:980 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe15⤵
- UAC bypass
- System policy modification
PID:236 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe16⤵
- UAC bypass
- System policy modification
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe17⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe18⤵
- Checks whether UAC is enabled
- System policy modification
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe19⤵
- UAC bypass
- System policy modification
PID:560 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe20⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe21⤵
- UAC bypass
- System policy modification
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe22⤵
- UAC bypass
- Checks whether UAC is enabled
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe23⤵
- UAC bypass
- Checks whether UAC is enabled
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe24⤵
- UAC bypass
- System policy modification
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe25⤵
- UAC bypass
- Checks whether UAC is enabled
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe26⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe27⤵
- UAC bypass
- System policy modification
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe28⤵
- UAC bypass
- Checks whether UAC is enabled
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe29⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe30⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe31⤵
- UAC bypass
- System policy modification
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe32⤵
- UAC bypass
- System policy modification
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe33⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe34⤵
- Checks whether UAC is enabled
- System policy modification
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe35⤵
- UAC bypass
- System policy modification
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe36⤵
- Checks whether UAC is enabled
- System policy modification
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe37⤵
- UAC bypass
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe38⤵
- Checks whether UAC is enabled
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe39⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe40⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe41⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe42⤵
- UAC bypass
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe43⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe44⤵
- UAC bypass
- System policy modification
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe45⤵
- Checks whether UAC is enabled
- System policy modification
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe46⤵
- System policy modification
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe47⤵
- Checks whether UAC is enabled
- System policy modification
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe48⤵
- UAC bypass
- System policy modification
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe49⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe50⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe51⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe52⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe53⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe54⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe55⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe56⤵
- UAC bypass
- System policy modification
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe57⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe58⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe59⤵
- System policy modification
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe60⤵
- UAC bypass
- System policy modification
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe61⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe62⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe63⤵
- UAC bypass
- System policy modification
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe64⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe65⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe66⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe67⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe68⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe69⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe70⤵
- UAC bypass
- System policy modification
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe71⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe72⤵
- UAC bypass
- System policy modification
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe73⤵
- Checks whether UAC is enabled
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe74⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe75⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe76⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe77⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe78⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe79⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe80⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe81⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe82⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe83⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe84⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe85⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe86⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe87⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe88⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe89⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe90⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe91⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe92⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe93⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe94⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe95⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe96⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe97⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe98⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe99⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe100⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe101⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe102⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe103⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe104⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe105⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe106⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe107⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe108⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe109⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe110⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe111⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe112⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe113⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe114⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe115⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe116⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe117⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe118⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe119⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe120⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe121⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe122⤵PID:2892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-