Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-10-2024 02:30
Static task
static1
Behavioral task
behavioral1
Sample
54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe
-
Size
193KB
-
MD5
54fcde8c178f2f1ccb6e2035ad93c4a0
-
SHA1
ffaff8395397e06e0e17a2ed830738e665286923
-
SHA256
61590230942f18b7af4dde5e14ca1b4794f852b13c4c1b3c653f780b2aa3d966
-
SHA512
7cc2e46e0b801bd3bc17fdf8001b0a8da9ae7984d8fe5135e75840b719850af4f2f5a9f6e45839a22e0c80525d401345a7fa7eb0d78a9f7fdabd29c038aa5c8d
-
SSDEEP
3072:HCjaEb7wZjRPiD2SdTXAWWIkKEPkR4xBqxVUtkO0ZdDa77/nHi9Cq/cd:HCOEbUZjRER1kvPkKFeDZdYaCq/cd
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (57) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
yOIkUssU.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\International\Geo\Nation yOIkUssU.exe -
Executes dropped EXE 2 IoCs
Processes:
yOIkUssU.exeqsIgUksk.exepid process 2888 yOIkUssU.exe 2320 qsIgUksk.exe -
Loads dropped DLL 20 IoCs
Processes:
54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeyOIkUssU.exepid process 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeyOIkUssU.exeqsIgUksk.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\yOIkUssU.exe = "C:\\Users\\Admin\\VwcMkcQg\\yOIkUssU.exe" 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qsIgUksk.exe = "C:\\ProgramData\\hywYUMQM\\qsIgUksk.exe" 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\yOIkUssU.exe = "C:\\Users\\Admin\\VwcMkcQg\\yOIkUssU.exe" yOIkUssU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qsIgUksk.exe = "C:\\ProgramData\\hywYUMQM\\qsIgUksk.exe" qsIgUksk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\YSIsUAUc.exe = "C:\\Users\\Admin\\gMgEEgoE\\YSIsUAUc.exe" 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MaMQIMoE.exe = "C:\\ProgramData\\YAcgQYcg\\MaMQIMoE.exe" 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
yOIkUssU.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico yOIkUssU.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2004 1740 WerFault.exe YSIsUAUc.exe 2300 2704 WerFault.exe MaMQIMoE.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.execmd.execmd.exereg.exereg.execmd.execscript.execmd.execmd.exereg.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exereg.execmd.exereg.exereg.exereg.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.execmd.exereg.exereg.execmd.exereg.execmd.exereg.execscript.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exereg.exereg.execmd.exereg.exereg.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.execmd.exereg.exereg.exereg.exereg.exereg.exereg.execmd.execmd.execmd.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exereg.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.execmd.execmd.execmd.execmd.execscript.execmd.exereg.execmd.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.execscript.exereg.exereg.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exereg.exereg.execscript.execscript.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2312 reg.exe 2576 reg.exe 536 reg.exe 2116 reg.exe 1860 reg.exe 1584 reg.exe 1608 reg.exe 2848 reg.exe 1736 reg.exe 2848 reg.exe 788 reg.exe 2396 reg.exe 2080 reg.exe 1976 reg.exe 2120 reg.exe 1408 reg.exe 1676 reg.exe 2388 reg.exe 2852 reg.exe 1768 reg.exe 2880 reg.exe 2996 reg.exe 2600 reg.exe 1912 reg.exe 2004 reg.exe 324 reg.exe 3008 reg.exe 1972 reg.exe 1508 reg.exe 1824 reg.exe 2204 reg.exe 804 reg.exe 2060 reg.exe 2612 reg.exe 2876 reg.exe 2400 reg.exe 1996 reg.exe 624 reg.exe 2788 reg.exe 320 reg.exe 652 reg.exe 2768 reg.exe 2040 reg.exe 2684 reg.exe 1052 reg.exe 1996 reg.exe 2648 reg.exe 1628 reg.exe 2916 reg.exe 960 reg.exe 544 reg.exe 1644 reg.exe 3044 reg.exe 1664 reg.exe 324 reg.exe 2912 reg.exe 1672 reg.exe 1796 reg.exe 1620 reg.exe 2784 reg.exe 2128 reg.exe 2640 reg.exe 1144 reg.exe 1188 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exepid process 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 3060 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 3060 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2816 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2816 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2996 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2996 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2008 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2008 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 892 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 892 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2680 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2680 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 884 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 884 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 304 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 304 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1824 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1824 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1976 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1976 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2776 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2776 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2100 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2100 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1160 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1160 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 576 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 576 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2172 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2172 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1972 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1972 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 676 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 676 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1276 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1276 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1300 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1300 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1708 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1708 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1536 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1536 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 996 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 996 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2448 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2448 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1784 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1784 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 448 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 448 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2364 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2364 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2012 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2012 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2588 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2588 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1944 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 1944 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2924 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe 2924 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
yOIkUssU.exepid process 2888 yOIkUssU.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
yOIkUssU.exepid process 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe 2888 yOIkUssU.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.execmd.execmd.exe54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.execmd.execmd.exedescription pid process target process PID 2248 wrote to memory of 2888 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe yOIkUssU.exe PID 2248 wrote to memory of 2888 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe yOIkUssU.exe PID 2248 wrote to memory of 2888 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe yOIkUssU.exe PID 2248 wrote to memory of 2888 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe yOIkUssU.exe PID 2248 wrote to memory of 2320 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe qsIgUksk.exe PID 2248 wrote to memory of 2320 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe qsIgUksk.exe PID 2248 wrote to memory of 2320 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe qsIgUksk.exe PID 2248 wrote to memory of 2320 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe qsIgUksk.exe PID 2248 wrote to memory of 2100 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 2248 wrote to memory of 2100 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 2248 wrote to memory of 2100 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 2248 wrote to memory of 2100 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 2248 wrote to memory of 2764 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2248 wrote to memory of 2764 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2248 wrote to memory of 2764 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2248 wrote to memory of 2764 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2248 wrote to memory of 2776 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2248 wrote to memory of 2776 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2248 wrote to memory of 2776 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2248 wrote to memory of 2776 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2248 wrote to memory of 2836 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2248 wrote to memory of 2836 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2248 wrote to memory of 2836 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2248 wrote to memory of 2836 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2248 wrote to memory of 2688 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 2248 wrote to memory of 2688 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 2248 wrote to memory of 2688 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 2248 wrote to memory of 2688 2248 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 2100 wrote to memory of 2876 2100 cmd.exe 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe PID 2100 wrote to memory of 2876 2100 cmd.exe 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe PID 2100 wrote to memory of 2876 2100 cmd.exe 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe PID 2100 wrote to memory of 2876 2100 cmd.exe 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe PID 2688 wrote to memory of 2724 2688 cmd.exe cscript.exe PID 2688 wrote to memory of 2724 2688 cmd.exe cscript.exe PID 2688 wrote to memory of 2724 2688 cmd.exe cscript.exe PID 2688 wrote to memory of 2724 2688 cmd.exe cscript.exe PID 2876 wrote to memory of 2140 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 2876 wrote to memory of 2140 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 2876 wrote to memory of 2140 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 2876 wrote to memory of 2140 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 2140 wrote to memory of 3060 2140 cmd.exe 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe PID 2140 wrote to memory of 3060 2140 cmd.exe 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe PID 2140 wrote to memory of 3060 2140 cmd.exe 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe PID 2140 wrote to memory of 3060 2140 cmd.exe 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe PID 2876 wrote to memory of 2296 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2876 wrote to memory of 2296 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2876 wrote to memory of 2296 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2876 wrote to memory of 2296 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2876 wrote to memory of 2788 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2876 wrote to memory of 2788 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2876 wrote to memory of 2788 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2876 wrote to memory of 2788 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2876 wrote to memory of 320 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2876 wrote to memory of 320 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2876 wrote to memory of 320 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2876 wrote to memory of 320 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe reg.exe PID 2876 wrote to memory of 324 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 2876 wrote to memory of 324 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 2876 wrote to memory of 324 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 2876 wrote to memory of 324 2876 54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe cmd.exe PID 324 wrote to memory of 1820 324 cmd.exe cscript.exe PID 324 wrote to memory of 1820 324 cmd.exe cscript.exe PID 324 wrote to memory of 1820 324 cmd.exe cscript.exe PID 324 wrote to memory of 1820 324 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\VwcMkcQg\yOIkUssU.exe"C:\Users\Admin\VwcMkcQg\yOIkUssU.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2888 -
C:\ProgramData\hywYUMQM\qsIgUksk.exe"C:\ProgramData\hywYUMQM\qsIgUksk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2320 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes1183⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes1185⤵
- Suspicious behavior: EnumeratesProcesses
PID:3060 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"6⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes1187⤵
- Suspicious behavior: EnumeratesProcesses
PID:2816 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"8⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes1189⤵
- Suspicious behavior: EnumeratesProcesses
PID:2996 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"10⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11811⤵
- Suspicious behavior: EnumeratesProcesses
PID:2008 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"12⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11813⤵
- Suspicious behavior: EnumeratesProcesses
PID:892 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"14⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11815⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2680 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"16⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11817⤵
- Suspicious behavior: EnumeratesProcesses
PID:884 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"18⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11819⤵
- Suspicious behavior: EnumeratesProcesses
PID:304 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"20⤵
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11821⤵
- Suspicious behavior: EnumeratesProcesses
PID:1824 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"22⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11823⤵
- Suspicious behavior: EnumeratesProcesses
PID:1976 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"24⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11825⤵
- Suspicious behavior: EnumeratesProcesses
PID:2776 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"26⤵
- System Location Discovery: System Language Discovery
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11827⤵
- Suspicious behavior: EnumeratesProcesses
PID:2100 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"28⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11829⤵
- Suspicious behavior: EnumeratesProcesses
PID:1160 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"30⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11831⤵
- Suspicious behavior: EnumeratesProcesses
PID:576 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"32⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11833⤵
- Suspicious behavior: EnumeratesProcesses
PID:2172 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"34⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11835⤵
- Suspicious behavior: EnumeratesProcesses
PID:1972 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"36⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11837⤵
- Suspicious behavior: EnumeratesProcesses
PID:676 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"38⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11839⤵
- Suspicious behavior: EnumeratesProcesses
PID:1276 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"40⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11841⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"42⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11843⤵
- Suspicious behavior: EnumeratesProcesses
PID:1708 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"44⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11845⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"46⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11847⤵
- Suspicious behavior: EnumeratesProcesses
PID:996 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"48⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11849⤵
- Suspicious behavior: EnumeratesProcesses
PID:2448 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"50⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11851⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1784 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"52⤵
- System Location Discovery: System Language Discovery
PID:808 -
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11853⤵
- Suspicious behavior: EnumeratesProcesses
PID:448 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"54⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11855⤵
- Suspicious behavior: EnumeratesProcesses
PID:2364 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"56⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11857⤵
- Suspicious behavior: EnumeratesProcesses
PID:2012 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"58⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11859⤵
- Suspicious behavior: EnumeratesProcesses
PID:2588 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"60⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11861⤵
- Suspicious behavior: EnumeratesProcesses
PID:1944 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"62⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11863⤵
- Suspicious behavior: EnumeratesProcesses
PID:2924 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"64⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11865⤵PID:2060
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"66⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11867⤵PID:2224
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"68⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11869⤵PID:1940
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"70⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11871⤵PID:2488
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"72⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11873⤵PID:2776
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"74⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11875⤵PID:1544
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"76⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11877⤵PID:304
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"78⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11879⤵
- Adds Run key to start application
PID:3008 -
C:\Users\Admin\gMgEEgoE\YSIsUAUc.exe"C:\Users\Admin\gMgEEgoE\YSIsUAUc.exe"80⤵PID:1740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 3681⤵
- Program crash
PID:2004 -
C:\ProgramData\YAcgQYcg\MaMQIMoE.exe"C:\ProgramData\YAcgQYcg\MaMQIMoE.exe"80⤵PID:2704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 3681⤵
- Program crash
PID:2300 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"80⤵
- System Location Discovery: System Language Discovery
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11881⤵PID:2080
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"82⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11883⤵PID:1976
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"84⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11885⤵PID:1276
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"86⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11887⤵PID:2280
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"88⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11889⤵PID:2928
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"90⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11891⤵PID:2596
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"92⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11893⤵PID:2604
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"94⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11895⤵PID:844
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"96⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11897⤵PID:624
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"98⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes11899⤵PID:992
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"100⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118101⤵
- System Location Discovery: System Language Discovery
PID:2056 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"102⤵
- System Location Discovery: System Language Discovery
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118103⤵PID:2784
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"104⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118105⤵PID:2796
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"106⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118107⤵PID:1684
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"108⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118109⤵PID:2260
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"110⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118111⤵PID:2824
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"112⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118113⤵PID:1528
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"114⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118115⤵PID:3012
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"116⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118117⤵PID:2768
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"118⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118119⤵PID:1188
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"120⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118121⤵PID:2012
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"122⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118123⤵PID:236
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"124⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118125⤵PID:2128
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"126⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118127⤵PID:852
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"128⤵
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118129⤵PID:3068
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"130⤵
- System Location Discovery: System Language Discovery
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118131⤵PID:2388
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"132⤵
- System Location Discovery: System Language Discovery
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118133⤵PID:2396
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"134⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118135⤵PID:1128
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"136⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118137⤵PID:2816
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"138⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118139⤵PID:2780
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"140⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118141⤵PID:1600
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"142⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118143⤵PID:1296
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"144⤵
- System Location Discovery: System Language Discovery
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118145⤵PID:2296
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"146⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118147⤵PID:648
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"148⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118149⤵PID:2096
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"150⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118151⤵PID:1716
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"152⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118153⤵PID:3040
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"154⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118155⤵PID:1640
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"156⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118157⤵PID:2848
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"158⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118159⤵PID:2448
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"160⤵
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118161⤵PID:1516
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"162⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118163⤵PID:1936
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"164⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118165⤵PID:808
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"166⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118167⤵PID:2780
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"168⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118169⤵PID:2692
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"170⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118171⤵PID:1720
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"172⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118173⤵PID:2600
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"174⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118175⤵PID:1592
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"176⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118177⤵PID:1716
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"178⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118179⤵PID:2028
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"180⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118181⤵
- System Location Discovery: System Language Discovery
PID:1736 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"182⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118183⤵PID:320
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"184⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118185⤵PID:2676
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"186⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118187⤵PID:1800
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"188⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118189⤵PID:2744
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"190⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118191⤵PID:2176
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"192⤵
- System Location Discovery: System Language Discovery
PID:952 -
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118193⤵PID:2668
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"194⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118195⤵PID:2100
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"196⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118197⤵PID:3028
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"198⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118199⤵
- System Location Discovery: System Language Discovery
PID:2520 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"200⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118201⤵PID:952
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"202⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118203⤵PID:2948
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"204⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118205⤵PID:2824
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"206⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118207⤵PID:1704
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"208⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118209⤵PID:1768
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"210⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118211⤵PID:772
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"212⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118213⤵PID:1660
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"214⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118215⤵PID:2056
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"216⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118217⤵PID:1688
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"218⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118219⤵PID:1276
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"220⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118221⤵PID:2368
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"222⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118223⤵PID:2548
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"224⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118225⤵PID:2420
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"226⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118227⤵PID:2692
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"228⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118229⤵PID:484
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"230⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118231⤵PID:2680
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"232⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118233⤵PID:960
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"234⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118235⤵PID:2520
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"236⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118237⤵
- System Location Discovery: System Language Discovery
PID:2144 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"238⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118239⤵PID:624
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"240⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118241⤵
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\54fcde8c178f2f1ccb6e2035ad93c4a0_JaffaCakes118"242⤵PID:2432