Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2024 02:19
Static task
static1
Behavioral task
behavioral1
Sample
54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe
-
Size
199KB
-
MD5
54f18252d65c0a4dcdf360055fd4bf82
-
SHA1
1ce81d8323d11e7b03421ce4030588026a6a81e7
-
SHA256
33e2695da4fe975e3945b6aafc539ef6ad61c4916b30b00bb5454fc4a9286d6c
-
SHA512
d4ba259bd8538c41e9a2c3c510f646edf9508afe1aac66717b7cf463ae7d61401e199378a6a8f0072cdc320a17595308e6f3a3ec02ef0866c66e3d2369951afa
-
SSDEEP
3072:oWkwzgGtfU6MW8zpoLJ+Fky0jwHPzoam2oxpy3PUszw+IyJ9EmOzFUO7QP7OLxRs:ogUJx2gRaA+mpmid
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (80) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
sGMwogQU.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation sGMwogQU.exe -
Executes dropped EXE 2 IoCs
Processes:
sGMwogQU.exeSMYcMAwM.exepid process 2296 sGMwogQU.exe 1916 SMYcMAwM.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
sGMwogQU.exeSMYcMAwM.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sGMwogQU.exe = "C:\\Users\\Admin\\JgkkYkMI\\sGMwogQU.exe" sGMwogQU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMYcMAwM.exe = "C:\\ProgramData\\JqIEUsAU\\SMYcMAwM.exe" SMYcMAwM.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sGMwogQU.exe = "C:\\Users\\Admin\\JgkkYkMI\\sGMwogQU.exe" 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMYcMAwM.exe = "C:\\ProgramData\\JqIEUsAU\\SMYcMAwM.exe" 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
Processes:
sGMwogQU.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe sGMwogQU.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe sGMwogQU.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cscript.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.execmd.execmd.execscript.execscript.execscript.exereg.exereg.execscript.execscript.execscript.exereg.exereg.exereg.exereg.execmd.exereg.exereg.execscript.execmd.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.execscript.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exereg.execmd.execmd.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exereg.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.execscript.execmd.exereg.execmd.execmd.exereg.execscript.exereg.execscript.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exereg.execscript.execscript.exereg.execmd.exereg.exereg.execmd.execmd.execmd.execscript.exereg.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exereg.exereg.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.execmd.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1088 reg.exe 4056 reg.exe 2964 reg.exe 2288 reg.exe 688 reg.exe 1596 reg.exe 1596 reg.exe 4632 reg.exe 3008 reg.exe 4916 reg.exe 1972 reg.exe 1168 reg.exe 4444 reg.exe 572 reg.exe 1088 reg.exe 3520 reg.exe 4432 1564 reg.exe 4016 reg.exe 3604 reg.exe 1300 reg.exe 5028 reg.exe 4840 reg.exe 5112 reg.exe 868 4852 3656 reg.exe 4016 reg.exe 2488 reg.exe 2104 reg.exe 4504 reg.exe 1976 reg.exe 5028 reg.exe 4144 3188 reg.exe 4124 reg.exe 3020 reg.exe 1988 3800 reg.exe 1760 3568 reg.exe 2748 reg.exe 1704 reg.exe 4568 reg.exe 3252 reg.exe 688 4016 reg.exe 1928 reg.exe 1444 4472 reg.exe 840 reg.exe 4144 reg.exe 688 reg.exe 4020 reg.exe 844 reg.exe 3292 reg.exe 2692 reg.exe 3796 reg.exe 884 reg.exe 4980 reg.exe 4816 3640 reg.exe 4488 reg.exe 4720 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exepid process 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 3620 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 3620 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 3620 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 3620 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 944 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 944 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 944 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 944 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2892 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2892 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2892 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2892 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 512 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 512 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 512 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 512 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2492 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2492 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2492 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2492 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 1432 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 1432 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 1432 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 1432 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2992 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2992 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2992 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2992 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 1980 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 1980 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 1980 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 1980 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4920 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4920 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4920 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4920 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4684 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4684 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4684 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4684 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2276 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2276 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2276 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 2276 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4832 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4832 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4832 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe 4832 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
sGMwogQU.exepid process 2296 sGMwogQU.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
sGMwogQU.exepid process 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe 2296 sGMwogQU.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.execmd.execmd.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.execmd.execmd.exe54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.execmd.exedescription pid process target process PID 1608 wrote to memory of 2296 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe sGMwogQU.exe PID 1608 wrote to memory of 2296 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe sGMwogQU.exe PID 1608 wrote to memory of 2296 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe sGMwogQU.exe PID 1608 wrote to memory of 1916 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe SMYcMAwM.exe PID 1608 wrote to memory of 1916 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe SMYcMAwM.exe PID 1608 wrote to memory of 1916 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe SMYcMAwM.exe PID 1608 wrote to memory of 4420 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe PID 1608 wrote to memory of 4420 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe PID 1608 wrote to memory of 4420 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe PID 4420 wrote to memory of 1912 4420 cmd.exe 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe PID 4420 wrote to memory of 1912 4420 cmd.exe 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe PID 4420 wrote to memory of 1912 4420 cmd.exe 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe PID 1608 wrote to memory of 3988 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1608 wrote to memory of 3988 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1608 wrote to memory of 3988 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1608 wrote to memory of 2380 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1608 wrote to memory of 2380 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1608 wrote to memory of 2380 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1608 wrote to memory of 4216 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1608 wrote to memory of 4216 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1608 wrote to memory of 4216 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1608 wrote to memory of 1928 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe PID 1608 wrote to memory of 1928 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe PID 1608 wrote to memory of 1928 1608 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe PID 1928 wrote to memory of 1972 1928 cmd.exe cscript.exe PID 1928 wrote to memory of 1972 1928 cmd.exe cscript.exe PID 1928 wrote to memory of 1972 1928 cmd.exe cscript.exe PID 1912 wrote to memory of 2988 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe PID 1912 wrote to memory of 2988 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe PID 1912 wrote to memory of 2988 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe PID 2988 wrote to memory of 4584 2988 cmd.exe 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe PID 2988 wrote to memory of 4584 2988 cmd.exe 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe PID 2988 wrote to memory of 4584 2988 cmd.exe 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe PID 1912 wrote to memory of 3532 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1912 wrote to memory of 3532 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1912 wrote to memory of 3532 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1912 wrote to memory of 2660 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1912 wrote to memory of 2660 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1912 wrote to memory of 2660 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1912 wrote to memory of 4712 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1912 wrote to memory of 4712 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1912 wrote to memory of 4712 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 1912 wrote to memory of 4668 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe PID 1912 wrote to memory of 4668 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe PID 1912 wrote to memory of 4668 1912 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe PID 4668 wrote to memory of 116 4668 cmd.exe cscript.exe PID 4668 wrote to memory of 116 4668 cmd.exe cscript.exe PID 4668 wrote to memory of 116 4668 cmd.exe cscript.exe PID 4584 wrote to memory of 556 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe PID 4584 wrote to memory of 556 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe PID 4584 wrote to memory of 556 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe PID 556 wrote to memory of 3620 556 cmd.exe 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe PID 556 wrote to memory of 3620 556 cmd.exe 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe PID 556 wrote to memory of 3620 556 cmd.exe 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe PID 4584 wrote to memory of 2232 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 4584 wrote to memory of 2232 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 4584 wrote to memory of 2232 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 4584 wrote to memory of 2476 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 4584 wrote to memory of 2476 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 4584 wrote to memory of 2476 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 4584 wrote to memory of 3432 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 4584 wrote to memory of 3432 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 4584 wrote to memory of 3432 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe reg.exe PID 4584 wrote to memory of 4220 4584 54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\JgkkYkMI\sGMwogQU.exe"C:\Users\Admin\JgkkYkMI\sGMwogQU.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2296 -
C:\ProgramData\JqIEUsAU\SMYcMAwM.exe"C:\ProgramData\JqIEUsAU\SMYcMAwM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"2⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes1183⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"4⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes1185⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"6⤵
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes1187⤵
- Suspicious behavior: EnumeratesProcesses
PID:3620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"8⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes1189⤵
- Suspicious behavior: EnumeratesProcesses
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"10⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11811⤵
- Suspicious behavior: EnumeratesProcesses
PID:2892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"12⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11813⤵
- Suspicious behavior: EnumeratesProcesses
PID:512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"14⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11815⤵
- Suspicious behavior: EnumeratesProcesses
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"16⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11817⤵
- Suspicious behavior: EnumeratesProcesses
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"18⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11819⤵
- Suspicious behavior: EnumeratesProcesses
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"20⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11821⤵
- Suspicious behavior: EnumeratesProcesses
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"22⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11823⤵
- Suspicious behavior: EnumeratesProcesses
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"24⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11825⤵
- Suspicious behavior: EnumeratesProcesses
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"26⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11827⤵
- Suspicious behavior: EnumeratesProcesses
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"28⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11829⤵
- Suspicious behavior: EnumeratesProcesses
PID:2276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"30⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11831⤵
- Suspicious behavior: EnumeratesProcesses
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"32⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11833⤵PID:2896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"34⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11835⤵PID:5048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"36⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11837⤵PID:668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"38⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11839⤵
- System Location Discovery: System Language Discovery
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"40⤵
- System Location Discovery: System Language Discovery
PID:4052 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11841⤵PID:3748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"42⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11843⤵PID:2180
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"44⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11845⤵PID:3928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"46⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11847⤵PID:1444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"48⤵PID:2912
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11849⤵PID:2484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"50⤵
- System Location Discovery: System Language Discovery
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11851⤵PID:3304
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"52⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11853⤵PID:2604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"54⤵PID:2868
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11855⤵PID:4972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"56⤵PID:1732
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11857⤵PID:4284
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"58⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11859⤵PID:4056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"60⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11861⤵PID:4192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"62⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11863⤵PID:1040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"64⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11865⤵PID:4284
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"66⤵PID:2960
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11867⤵PID:4528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"68⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11869⤵PID:372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"70⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11871⤵PID:4972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"72⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11873⤵PID:4360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"74⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11875⤵PID:4732
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"76⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11877⤵PID:4220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"78⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11879⤵PID:1764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"80⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11881⤵PID:1492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"82⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11883⤵PID:4528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"84⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11885⤵PID:4640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"86⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11887⤵PID:4936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"88⤵PID:4832
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11889⤵PID:4712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"90⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11891⤵PID:3020
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"92⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11893⤵PID:772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"94⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11895⤵PID:1068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"96⤵PID:844
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11897⤵PID:4592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"98⤵PID:4764
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes11899⤵PID:4832
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"100⤵PID:5032
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118101⤵PID:316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"102⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118103⤵PID:2748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"104⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118105⤵PID:1564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"106⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118107⤵PID:4220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"108⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118109⤵PID:4816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"110⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118111⤵PID:4472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"112⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118113⤵PID:2228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"114⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118115⤵PID:3236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"116⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118117⤵PID:2212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"118⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118119⤵PID:1432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"120⤵PID:2036
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118121⤵PID:1492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"122⤵PID:3928
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118123⤵PID:4580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"124⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118125⤵PID:1312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"126⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118127⤵PID:2912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"128⤵PID:1564
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1129⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118129⤵PID:4728
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"130⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118131⤵PID:4220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"132⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118133⤵PID:1424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"134⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118135⤵PID:2476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"136⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118137⤵PID:4640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"138⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118139⤵PID:4376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"140⤵PID:2604
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1141⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118141⤵PID:4860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"142⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118143⤵PID:2784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"144⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118145⤵
- System Location Discovery: System Language Discovery
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"146⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118147⤵PID:4544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"148⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118149⤵PID:1524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"150⤵
- System Location Discovery: System Language Discovery
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118151⤵PID:1988
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"152⤵PID:2604
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1153⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118153⤵PID:3240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"154⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118155⤵PID:4592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"156⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118157⤵PID:4832
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"158⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118159⤵
- System Location Discovery: System Language Discovery
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"160⤵
- System Location Discovery: System Language Discovery
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118161⤵PID:2692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"162⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118163⤵PID:3800
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"164⤵PID:4684
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1165⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118165⤵PID:944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"166⤵
- System Location Discovery: System Language Discovery
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118167⤵PID:656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"168⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118169⤵PID:1492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"170⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118171⤵PID:1636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"172⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118173⤵PID:4616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"174⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118175⤵
- System Location Discovery: System Language Discovery
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"176⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118177⤵PID:2872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"178⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118179⤵PID:1760
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"180⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118181⤵PID:4824
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"182⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118183⤵PID:4992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"184⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118185⤵PID:4528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"186⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118187⤵PID:3620
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"188⤵PID:4192
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1189⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118189⤵
- System Location Discovery: System Language Discovery
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"190⤵
- System Location Discovery: System Language Discovery
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118191⤵PID:4744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"192⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118193⤵PID:1136
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"194⤵PID:4488
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1195⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118195⤵PID:2856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"196⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118197⤵PID:772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"198⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118199⤵
- System Location Discovery: System Language Discovery
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"200⤵PID:2660
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1201⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118201⤵PID:2112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"202⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118203⤵PID:1760
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"204⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118205⤵PID:3304
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"206⤵PID:3324
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1207⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118207⤵PID:4988
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"208⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118209⤵PID:3536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"210⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118211⤵PID:4536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"212⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118213⤵PID:4472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"214⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118215⤵PID:3744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"216⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118217⤵PID:4568
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"218⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118219⤵PID:2692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"220⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118221⤵PID:4628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"222⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118223⤵PID:5032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"224⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118225⤵PID:3656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"226⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118227⤵PID:2228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"228⤵PID:3240
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1229⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118229⤵PID:3400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"230⤵PID:1608
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1231⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118231⤵PID:944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"232⤵
- System Location Discovery: System Language Discovery
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118233⤵PID:2572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"234⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118235⤵PID:4352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"236⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118237⤵PID:3516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"238⤵PID:4592
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1239⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118239⤵PID:1996
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"240⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118241⤵PID:3560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\54f18252d65c0a4dcdf360055fd4bf82_JaffaCakes118"242⤵PID:5112