Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2025, 09:06

General

  • Target

    JaffaCakes118_047c408df84c32f8d5712456276d1680.exe

  • Size

    481KB

  • MD5

    047c408df84c32f8d5712456276d1680

  • SHA1

    c058964b23389b0a66e8383c9070245b12b9b9f6

  • SHA256

    0c07ac694ef7558a4e2277d2076fb1a432992648748e38ac2b4db4beab1bc6d8

  • SHA512

    3c98cebb9e4aa878ec2838e6516342d3b12e783c66f1c2c73f2914439f2e5902b122d840aadce02e70cda7c7ddf16fa9d06f0ba5d384699b101981b54c1a375a

  • SSDEEP

    12288:FlYqg3oqi+8R7YrQ2j+zxgJLavC1YU3B4P0Tno31kUrQeG:jdpYrYz6A0zg1TrQJ

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 27 IoCs
  • UAC bypass 3 TTPs 27 IoCs
  • Renames multiple (51) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 7 IoCs
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3304
    • C:\Users\Admin\hkwMwwsw\RIIoEoMU.exe
      "C:\Users\Admin\hkwMwwsw\RIIoEoMU.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:3924
    • C:\ProgramData\SsoAQgEQ\ggswYEgU.exe
      "C:\ProgramData\SsoAQgEQ\ggswYEgU.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4620
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3152
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4908
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2812
          • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
            C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2116
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1524
              • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2052
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                  8⤵
                    PID:5372
                    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                      9⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3704
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:2144
                        • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                          C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                          11⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3288
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                            12⤵
                              PID:6008
                              • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                13⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5156
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                  14⤵
                                    PID:224
                                    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                      15⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3216
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                        16⤵
                                          PID:4164
                                          • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                            C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                            17⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4256
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                              18⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1432
                                              • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                19⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:5696
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                  20⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2000
                                                  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                    C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                    21⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4360
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                      22⤵
                                                        PID:1056
                                                        • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                          C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                          23⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:2712
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                            24⤵
                                                              PID:3544
                                                              • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                                C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                                25⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1904
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                                  26⤵
                                                                    PID:452
                                                                    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                                      27⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:3848
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                                        28⤵
                                                                          PID:5720
                                                                          • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                                            29⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:5880
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                                              30⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1748
                                                                              • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                                                31⤵
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:2800
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                                                  32⤵
                                                                                    PID:3780
                                                                                    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                                                      33⤵
                                                                                        PID:4852
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                                                          34⤵
                                                                                            PID:5232
                                                                                            • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                                                              35⤵
                                                                                                PID:5592
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                                                                  36⤵
                                                                                                    PID:1064
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                                                                      37⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:5480
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                                                                        38⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:2936
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                                                                          39⤵
                                                                                                            PID:5372
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                                                                              40⤵
                                                                                                                PID:5616
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                                                                                  41⤵
                                                                                                                    PID:3672
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                                                                                      42⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:4256
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                                                                                        43⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:552
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                                                                                          44⤵
                                                                                                                            PID:5276
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                                                                                              45⤵
                                                                                                                                PID:376
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                                                                                                  46⤵
                                                                                                                                    PID:1972
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                                                                                                      47⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2956
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                                                                                                        48⤵
                                                                                                                                          PID:2876
                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                            49⤵
                                                                                                                                              PID:5616
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                                                                                                              49⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:64
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                                                                                                                50⤵
                                                                                                                                                  PID:4596
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                                                                                                                    51⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4496
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                                                                                                                      52⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:2008
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680
                                                                                                                                                        53⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:1620
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680"
                                                                                                                                                          54⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1068
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                          54⤵
                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:2996
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                          54⤵
                                                                                                                                                            PID:3144
                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                              55⤵
                                                                                                                                                                PID:4492
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                              54⤵
                                                                                                                                                              • UAC bypass
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:1804
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iAIgQYYs.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                              54⤵
                                                                                                                                                                PID:4516
                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                  55⤵
                                                                                                                                                                    PID:4908
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                              52⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:5524
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                              52⤵
                                                                                                                                                                PID:1748
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                52⤵
                                                                                                                                                                • UAC bypass
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:5992
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mUAQYkcg.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                                52⤵
                                                                                                                                                                  PID:5152
                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                    53⤵
                                                                                                                                                                      PID:1420
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                50⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:392
                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  51⤵
                                                                                                                                                                    PID:1064
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                  50⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:4212
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                  50⤵
                                                                                                                                                                  • UAC bypass
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:4944
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wyQMUcMI.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                                  50⤵
                                                                                                                                                                    PID:1872
                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                      51⤵
                                                                                                                                                                        PID:2768
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                  48⤵
                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:632
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                  48⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:2984
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                  48⤵
                                                                                                                                                                  • UAC bypass
                                                                                                                                                                  PID:5516
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TQQYsQoI.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                                  48⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:2568
                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                    49⤵
                                                                                                                                                                      PID:5888
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                46⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:1084
                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  47⤵
                                                                                                                                                                    PID:4480
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                  46⤵
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:5076
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                  46⤵
                                                                                                                                                                  • UAC bypass
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:4704
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dwssIgAI.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                                  46⤵
                                                                                                                                                                    PID:3304
                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                      47⤵
                                                                                                                                                                        PID:804
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                  44⤵
                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:536
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                  44⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:1944
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                  44⤵
                                                                                                                                                                  • UAC bypass
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:5816
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hwQwIkUE.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                                  44⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:3224
                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                    45⤵
                                                                                                                                                                      PID:5772
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                42⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:4492
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                42⤵
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:3756
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                42⤵
                                                                                                                                                                • UAC bypass
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:2068
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QYIwgcks.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                                42⤵
                                                                                                                                                                  PID:5328
                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                    43⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:3068
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                              40⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:1320
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                              40⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:1792
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                              40⤵
                                                                                                                                                              • UAC bypass
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:5380
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QoowEwEc.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                              40⤵
                                                                                                                                                                PID:5552
                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                  41⤵
                                                                                                                                                                    PID:4984
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                              38⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:3272
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                              38⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:1732
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                              38⤵
                                                                                                                                                              • UAC bypass
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:4520
                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                39⤵
                                                                                                                                                                  PID:388
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TyogYcQw.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                                38⤵
                                                                                                                                                                  PID:4480
                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                    39⤵
                                                                                                                                                                      PID:5936
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                36⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:2728
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                36⤵
                                                                                                                                                                  PID:5212
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                  36⤵
                                                                                                                                                                  • UAC bypass
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:4516
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vScEAooY.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                                  36⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5492
                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                    37⤵
                                                                                                                                                                      PID:1204
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                34⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:5860
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                34⤵
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:4136
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                34⤵
                                                                                                                                                                • UAC bypass
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:2068
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\beUEMMYs.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                                34⤵
                                                                                                                                                                  PID:1460
                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                    35⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4380
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                              32⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:5076
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                              32⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:3972
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                              32⤵
                                                                                                                                                              • UAC bypass
                                                                                                                                                              PID:2280
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wMUYswgw.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                              32⤵
                                                                                                                                                                PID:5080
                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                  33⤵
                                                                                                                                                                    PID:6072
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                              30⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:5312
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                              30⤵
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:4452
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                              30⤵
                                                                                                                                                              • UAC bypass
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:1972
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qGsUIYcs.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                              30⤵
                                                                                                                                                                PID:2040
                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                  31⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4208
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                            28⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            • Modifies registry key
                                                                                                                                                            PID:5156
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                            28⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            • Modifies registry key
                                                                                                                                                            PID:4876
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                            28⤵
                                                                                                                                                            • UAC bypass
                                                                                                                                                            • Modifies registry key
                                                                                                                                                            PID:1808
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qmkcgIUs.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                            28⤵
                                                                                                                                                              PID:4044
                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                29⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3772
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                          26⤵
                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:388
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                          26⤵
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:2544
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                          26⤵
                                                                                                                                                          • UAC bypass
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:624
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KgkYAYIw.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                          26⤵
                                                                                                                                                            PID:2748
                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                              27⤵
                                                                                                                                                                PID:1416
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                          24⤵
                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:3208
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                          24⤵
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:5728
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                          24⤵
                                                                                                                                                          • UAC bypass
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:5604
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VecwEUkQ.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                          24⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:4932
                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                            25⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:5144
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                      22⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3440
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                      22⤵
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:2728
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                      22⤵
                                                                                                                                                      • UAC bypass
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:5064
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JOwwYwQA.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                      22⤵
                                                                                                                                                        PID:5868
                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                          23⤵
                                                                                                                                                            PID:5032
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                      20⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:2760
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                      20⤵
                                                                                                                                                        PID:4732
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                        20⤵
                                                                                                                                                        • UAC bypass
                                                                                                                                                        • Modifies registry key
                                                                                                                                                        PID:1440
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lacEkMgI.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                        20⤵
                                                                                                                                                          PID:632
                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                            21⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:548
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                      18⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:1996
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                      18⤵
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:464
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                      18⤵
                                                                                                                                                      • UAC bypass
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:4928
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AyIsEwcI.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                      18⤵
                                                                                                                                                        PID:4940
                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                          19⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:2216
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                    16⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:2344
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                    16⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:2564
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                    16⤵
                                                                                                                                                    • UAC bypass
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:656
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KccAYcMs.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                    16⤵
                                                                                                                                                      PID:2460
                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                        17⤵
                                                                                                                                                          PID:4788
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                    14⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:1908
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                    14⤵
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:2268
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                    14⤵
                                                                                                                                                    • UAC bypass
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:4448
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DekMwEEY.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                    14⤵
                                                                                                                                                      PID:1592
                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                        15⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:5524
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                  12⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  PID:1004
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                  12⤵
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:3192
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                  12⤵
                                                                                                                                                  • UAC bypass
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:5988
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pWkIsMYo.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                  12⤵
                                                                                                                                                    PID:1288
                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                      13⤵
                                                                                                                                                        PID:5880
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                  10⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:1452
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                  10⤵
                                                                                                                                                    PID:3224
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                    10⤵
                                                                                                                                                    • UAC bypass
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:4284
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wSIsgscU.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                    10⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1808
                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                      11⤵
                                                                                                                                                        PID:6080
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                  8⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:5556
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                  8⤵
                                                                                                                                                    PID:1144
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                    8⤵
                                                                                                                                                    • UAC bypass
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:5032
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iuwEoggU.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                    8⤵
                                                                                                                                                      PID:5896
                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                        9⤵
                                                                                                                                                          PID:2480
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                    6⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:5668
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                    6⤵
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:4724
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                    6⤵
                                                                                                                                                    • UAC bypass
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:5868
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IqAEMgQs.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                    6⤵
                                                                                                                                                      PID:4560
                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                        7⤵
                                                                                                                                                          PID:1804
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                    4⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    PID:4360
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                    4⤵
                                                                                                                                                      PID:2760
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                      4⤵
                                                                                                                                                      • UAC bypass
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:4984
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OGQUEQkM.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                      4⤵
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:1976
                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                        5⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:1336
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                  2⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:1996
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                  2⤵
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:4892
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                  2⤵
                                                                                                                                                  • UAC bypass
                                                                                                                                                  PID:4916
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EscsMsgc.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680.exe""
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3232
                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1456
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\hkwMwwsw\RIIoEoMU.exe
                                                                                                                                                    1⤵
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:3336
                                                                                                                                                    • C:\Users\Admin\hkwMwwsw\RIIoEoMU.exe
                                                                                                                                                      C:\Users\Admin\hkwMwwsw\RIIoEoMU.exe
                                                                                                                                                      2⤵
                                                                                                                                                      • Checks computer location settings
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                      PID:5068
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\ProgramData\SsoAQgEQ\ggswYEgU.exe
                                                                                                                                                    1⤵
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:3140
                                                                                                                                                    • C:\ProgramData\SsoAQgEQ\ggswYEgU.exe
                                                                                                                                                      C:\ProgramData\SsoAQgEQ\ggswYEgU.exe
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      PID:2044
                                                                                                                                                  • C:\ProgramData\VIUYgsog\EKAcAsMs.exe
                                                                                                                                                    C:\ProgramData\VIUYgsog\EKAcAsMs.exe
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    PID:4628
                                                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                    1⤵
                                                                                                                                                      PID:5888

                                                                                                                                                    Network

                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                          Replay Monitor

                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                          Downloads

                                                                                                                                                          • C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe

                                                                                                                                                            Filesize

                                                                                                                                                            927KB

                                                                                                                                                            MD5

                                                                                                                                                            007475f79d444cedc6c6c7feeda57209

                                                                                                                                                            SHA1

                                                                                                                                                            c6a14922b823d95f32d0e025c8a13d61b3b9f0ff

                                                                                                                                                            SHA256

                                                                                                                                                            c2be50c1ebb6f519bc6483f04ab0c0777210c40a1ae4ce30054306d37f929541

                                                                                                                                                            SHA512

                                                                                                                                                            130ebeb8f1061f998b5eabcb4df28a9c78e76438796aaeecc3efc703e50f9d64f7b21886adfe654fbbe8ae97da2739d96c11b55e090d378e18a65b3d16f3ad57

                                                                                                                                                          • C:\ProgramData\SsoAQgEQ\ggswYEgU.exe

                                                                                                                                                            Filesize

                                                                                                                                                            466KB

                                                                                                                                                            MD5

                                                                                                                                                            c9484c198135fa759d0d932fc15eca0b

                                                                                                                                                            SHA1

                                                                                                                                                            4ffe6f55f837706feb152a2faebaf1ae2285ddea

                                                                                                                                                            SHA256

                                                                                                                                                            6f63a1f5c7a817309c27b39d02980a194f27b6f65c45b2f6d142c3528dc64bc8

                                                                                                                                                            SHA512

                                                                                                                                                            edab5eb9d4e12528ae9fd73578b011c8fba502da89722bf24213142ca28c3eb2f500c617fe09602c6abf554206651b8618dd0ddf82297ea89e39f4d34a1e8fc5

                                                                                                                                                          • C:\ProgramData\VIUYgsog\EKAcAsMs.exe

                                                                                                                                                            Filesize

                                                                                                                                                            468KB

                                                                                                                                                            MD5

                                                                                                                                                            e3f26bfa9c2bd95be3bac31450f5eda9

                                                                                                                                                            SHA1

                                                                                                                                                            cad4aed7326c374d9168bc6f44a8c674f78f65d2

                                                                                                                                                            SHA256

                                                                                                                                                            60a67ffbc2620970deddcffc50ba77a661bda8f831ddaf3aff0389b9589522b6

                                                                                                                                                            SHA512

                                                                                                                                                            7f5309204c295d9aef9f141816b7527588b9727d5d95462fc091a5a229af09ff416dae6c06ebd9acf4a94712a87ca5b67141bc4a7fd0ae26b86c608cfe3ddb6d

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png.exe

                                                                                                                                                            Filesize

                                                                                                                                                            475KB

                                                                                                                                                            MD5

                                                                                                                                                            f17937c400304ef1e2a4ddaec8ebf340

                                                                                                                                                            SHA1

                                                                                                                                                            a907180f61d2962c7caf7307aa64ddc8ea6a2972

                                                                                                                                                            SHA256

                                                                                                                                                            a05bf277c327b52211a5cb0573b5088b2038e719d452d6ce5f61d488982675d2

                                                                                                                                                            SHA512

                                                                                                                                                            c8a0b07907812595ca38a039ab87a392916719bd569ef657741c527569c5e1157116fb23bde1b861adeb84f176f2047dfab2a72942d2f7414b5d0af7ebbaffb9

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_047c408df84c32f8d5712456276d1680

                                                                                                                                                            Filesize

                                                                                                                                                            6KB

                                                                                                                                                            MD5

                                                                                                                                                            a137db26123ef0010b9a5a32a99280dc

                                                                                                                                                            SHA1

                                                                                                                                                            5bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6

                                                                                                                                                            SHA256

                                                                                                                                                            ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd

                                                                                                                                                            SHA512

                                                                                                                                                            b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OGQUEQkM.bat

                                                                                                                                                            Filesize

                                                                                                                                                            112B

                                                                                                                                                            MD5

                                                                                                                                                            bae1095f340720d965898063fede1273

                                                                                                                                                            SHA1

                                                                                                                                                            455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                            SHA256

                                                                                                                                                            ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                            SHA512

                                                                                                                                                            4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                            Filesize

                                                                                                                                                            19B

                                                                                                                                                            MD5

                                                                                                                                                            4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                            SHA1

                                                                                                                                                            170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                            SHA256

                                                                                                                                                            59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                            SHA512

                                                                                                                                                            16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                          • C:\Users\Admin\hkwMwwsw\RIIoEoMU.exe

                                                                                                                                                            Filesize

                                                                                                                                                            471KB

                                                                                                                                                            MD5

                                                                                                                                                            bdf66af55f453a9df62681f38d18c176

                                                                                                                                                            SHA1

                                                                                                                                                            7108eb8f9abc2cfebf46673ec3e2a76efcf49fdf

                                                                                                                                                            SHA256

                                                                                                                                                            ad294f4660ca66d8f56eb4227a242daacf44434015106d64417500e9b80ce5da

                                                                                                                                                            SHA512

                                                                                                                                                            43ff204cb977e6ef9674b23bcac59578e1b3acfb1e3d88af440ae443ffe6f816b25bb1a3706bd9dfb8ff2ddd409ff3b3518f797f4461a5a63c695d516061f83f

                                                                                                                                                          • C:\Windows\SysWOW64\CAYQ.exe

                                                                                                                                                            Filesize

                                                                                                                                                            480KB

                                                                                                                                                            MD5

                                                                                                                                                            bd5ff40fbfc0a005a0e2ff2f296a6196

                                                                                                                                                            SHA1

                                                                                                                                                            6baa8fd1677f78d9d562e631e81d10dbc27424cd

                                                                                                                                                            SHA256

                                                                                                                                                            031c8b668d6860875b0fa8570b110912dc05f033ed197bfb6201e661810ec7b4

                                                                                                                                                            SHA512

                                                                                                                                                            13818c28fca9716581b7d274d030e79ef739bd443a84098acfa93855d978fa666587247b49de7c90b64a7e2122b64c47827e378c4025883428a41efb0dead6bb

                                                                                                                                                          • C:\Windows\SysWOW64\CQoA.exe

                                                                                                                                                            Filesize

                                                                                                                                                            1.1MB

                                                                                                                                                            MD5

                                                                                                                                                            124f03f00c24a506ea554d137801d323

                                                                                                                                                            SHA1

                                                                                                                                                            9b1563c3806e68f4eb7d67c0f7c42d175f1d6020

                                                                                                                                                            SHA256

                                                                                                                                                            5cb41d58e3fa98f58edd6c81393a0041664456a0fe8c89002a3a6cecc0ed7326

                                                                                                                                                            SHA512

                                                                                                                                                            95d627acc63776e2f693ac291e23fa39d997ba4e9ab64f8492f940b9269265d3c318cc9fdaed180246cb6dedfc9bba10e0628643dc84203a98f836227327b5ea

                                                                                                                                                          • C:\Windows\SysWOW64\EwYm.exe

                                                                                                                                                            Filesize

                                                                                                                                                            474KB

                                                                                                                                                            MD5

                                                                                                                                                            fcabbc4815979d49f4c1f35d8f625875

                                                                                                                                                            SHA1

                                                                                                                                                            e7c2cb50b9e01c012e9310fc19e4053f9ba86fa1

                                                                                                                                                            SHA256

                                                                                                                                                            03d5e0f3d5fdfa775ef064ad4c6e5e8c0161ff337a831124a36456d2c486b55d

                                                                                                                                                            SHA512

                                                                                                                                                            8ed8c8807bf08b08f0c78fce209922c1e961fa211e2db22259670614b1c08d56b82b6e24e485112068a0aa7a3a7128ac9e8ef89152b100cfca873230bf75f771

                                                                                                                                                          • C:\Windows\SysWOW64\GEcw.exe

                                                                                                                                                            Filesize

                                                                                                                                                            475KB

                                                                                                                                                            MD5

                                                                                                                                                            eafe1a175306159f775d4ab9a5461b81

                                                                                                                                                            SHA1

                                                                                                                                                            03dc89f71e32c360123108269978a2883613ab58

                                                                                                                                                            SHA256

                                                                                                                                                            29ef1fa885fa46e7c341859eac641da69d8bedde6e0b1b807456e1d9fe6c33cd

                                                                                                                                                            SHA512

                                                                                                                                                            4251641aec86e4d322a8340af213ea28aba02f3746b3e012802019c4bcb14f0722831f79b51feebd5499743fda4e1717cf62a227f64ef626d474a64ad0c859bd

                                                                                                                                                          • C:\Windows\SysWOW64\GEkg.ico

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            MD5

                                                                                                                                                            f31b7f660ecbc5e170657187cedd7942

                                                                                                                                                            SHA1

                                                                                                                                                            42f5efe966968c2b1f92fadd7c85863956014fb4

                                                                                                                                                            SHA256

                                                                                                                                                            684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6

                                                                                                                                                            SHA512

                                                                                                                                                            62787378cea556d2f13cd567ae8407a596139943af4405e8def302d62f64e19edb258dce44429162ac78b7cfc2260915c93ff6b114b0f910d8d64bf61bdd0462

                                                                                                                                                          • C:\Windows\SysWOW64\IgAW.exe

                                                                                                                                                            Filesize

                                                                                                                                                            473KB

                                                                                                                                                            MD5

                                                                                                                                                            ac8df4980a761b13521203ce474dd3f8

                                                                                                                                                            SHA1

                                                                                                                                                            f269327d38a0d59016c1b36419d7f35e71963855

                                                                                                                                                            SHA256

                                                                                                                                                            1b24c575964b3cd393f4784ddd13536ff7cf32c308385f70698e61421c38876f

                                                                                                                                                            SHA512

                                                                                                                                                            90ac8a5a0f554032e2c6777a337cc318e8b80ba16cd79fbf030db7e8d384422070fc49aa226e819d58053f6293f60aff614c56f1a801d68e36254f62d2e16abc

                                                                                                                                                          • C:\Windows\SysWOW64\IgEY.exe

                                                                                                                                                            Filesize

                                                                                                                                                            476KB

                                                                                                                                                            MD5

                                                                                                                                                            9215dc85f95a4e8292559d1ddf1a5e55

                                                                                                                                                            SHA1

                                                                                                                                                            f96632bea0e1280425a79dffde43434191a33284

                                                                                                                                                            SHA256

                                                                                                                                                            65a3934016242fd01554cc5119a8380edf9be155905aef10ee4c2ad4b1062304

                                                                                                                                                            SHA512

                                                                                                                                                            783fde414bb06fd4c7a205657ea1dac54720f14c2adccee16a8ba22aff794ec2000a18fa95a6ddd94d4390bde3f24744eb7fca030e6a6c68fd8ef5979996212e

                                                                                                                                                          • C:\Windows\SysWOW64\IwQu.exe

                                                                                                                                                            Filesize

                                                                                                                                                            925KB

                                                                                                                                                            MD5

                                                                                                                                                            0f331d24d6715081e2970fdfee0abb7a

                                                                                                                                                            SHA1

                                                                                                                                                            20ce288a8b4846b01db6a38602e0af8095e24e09

                                                                                                                                                            SHA256

                                                                                                                                                            f3e4e80fdd45b8a8b262bd71feca7248dabc998e086669cb586a1ba0e60c43c8

                                                                                                                                                            SHA512

                                                                                                                                                            25d57c9dc01fb2dade0cb3d1b7b698033fe1933ed6de288c275bd9d927611a692a75481915c767695f818fa62622107c0ff7c1fb38106e3f06b35c9687fee167

                                                                                                                                                          • C:\Windows\SysWOW64\Mowo.exe

                                                                                                                                                            Filesize

                                                                                                                                                            472KB

                                                                                                                                                            MD5

                                                                                                                                                            4c413c831a08525906fc3926d9419fc9

                                                                                                                                                            SHA1

                                                                                                                                                            8d011a50906be87267921b99dc444712b0148910

                                                                                                                                                            SHA256

                                                                                                                                                            f96b6c9e221bd1166f8ee9f44cadc212f91f4f84d686eb3e321970c6023c7e3e

                                                                                                                                                            SHA512

                                                                                                                                                            856b1654c2da16d28776d0dc1421fba4c7ec8920324779e5b506d0c0f247b013a7487dda8de075ecbe2d522b3a81186d5f72de58db42f94eb74e5078997d3221

                                                                                                                                                          • C:\Windows\SysWOW64\OQoc.exe

                                                                                                                                                            Filesize

                                                                                                                                                            476KB

                                                                                                                                                            MD5

                                                                                                                                                            10bf96db851b957a313044189a892ef0

                                                                                                                                                            SHA1

                                                                                                                                                            7d1050080974b76f4bacfe6b139bce810fc557d7

                                                                                                                                                            SHA256

                                                                                                                                                            ef1a73ab2468be396447bfcc15209ec85f5391ca29b02224043262806a37f616

                                                                                                                                                            SHA512

                                                                                                                                                            7030fe61086a259c30e9de823014154f30e095999242f41eb776b0f91f81146a73fd53d351294d57de01d5c883c5ae693eefcf421270cc96e345f9c1b6d66ef6

                                                                                                                                                          • C:\Windows\SysWOW64\Owwo.exe

                                                                                                                                                            Filesize

                                                                                                                                                            6.2MB

                                                                                                                                                            MD5

                                                                                                                                                            6832a855a232cbf63c59becfa95d11c4

                                                                                                                                                            SHA1

                                                                                                                                                            9322ced5f05480c6e6adecfc80103911a1bd9859

                                                                                                                                                            SHA256

                                                                                                                                                            0fe0fdff45ffd6e65c41ac0016527c6722fbd7b4f77206d93fd9b99d764bbfd2

                                                                                                                                                            SHA512

                                                                                                                                                            d41c59f5ec6d36d631783baa3ec82c4c8f93a9a5509186f419609bd3e055063508d42eefcc875907853a468413896c40412204dabe8550b936411820d8882727

                                                                                                                                                          • C:\Windows\SysWOW64\QQgQ.ico

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            MD5

                                                                                                                                                            ac4b56cc5c5e71c3bb226181418fd891

                                                                                                                                                            SHA1

                                                                                                                                                            e62149df7a7d31a7777cae68822e4d0eaba2199d

                                                                                                                                                            SHA256

                                                                                                                                                            701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3

                                                                                                                                                            SHA512

                                                                                                                                                            a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998

                                                                                                                                                          • C:\Windows\SysWOW64\QUQs.exe

                                                                                                                                                            Filesize

                                                                                                                                                            482KB

                                                                                                                                                            MD5

                                                                                                                                                            8e335ca939bfc213ba2cf205b3a5289a

                                                                                                                                                            SHA1

                                                                                                                                                            9404f26cdaed6574d36af756027332ae36b7be1a

                                                                                                                                                            SHA256

                                                                                                                                                            8762a7bd65a06eeddf3f45d31f00b18fd7318a3540467b5b80cb699c7e535af4

                                                                                                                                                            SHA512

                                                                                                                                                            16e3ce2b0671802752162e85d7b6052ec3fc30f1f061f4a2c948d650aea31872b787b17d24ed255c20d169fd3378ac7b5e5271f5af7bcfd022ba733d8ef29c9b

                                                                                                                                                          • C:\Windows\SysWOW64\QsIs.exe

                                                                                                                                                            Filesize

                                                                                                                                                            481KB

                                                                                                                                                            MD5

                                                                                                                                                            765022b0f6479756312dae69164ec5ef

                                                                                                                                                            SHA1

                                                                                                                                                            1a67e3db4d1dbf569c6fe549138f966e47fdbaa2

                                                                                                                                                            SHA256

                                                                                                                                                            2560ade81c9c7d6dda6a1505a5a8a09402d6882be7847bc6343e0bee26e31e58

                                                                                                                                                            SHA512

                                                                                                                                                            e5d5d95a9f9c710193f12a931ef4cb8a3459ffd64b24011350cd90026056b662cf5ee91052074e6af3884035c7da4feab3a54e5c8ed87f088478f9eb8718ecbb

                                                                                                                                                          • C:\Windows\SysWOW64\SIow.exe

                                                                                                                                                            Filesize

                                                                                                                                                            598KB

                                                                                                                                                            MD5

                                                                                                                                                            8783abd64994bc25307357b8dd06e93e

                                                                                                                                                            SHA1

                                                                                                                                                            3ff9b542642b0b0988c0c72d63cdb347f368c918

                                                                                                                                                            SHA256

                                                                                                                                                            fa8e736986d5aaf08bb3d6860b00bce2b4b414f4d6d2aa98216a1ae5bcdfdec1

                                                                                                                                                            SHA512

                                                                                                                                                            17b66900fe2794b14fa8becaaa5c1cb888741305ef046f761a8172861a14c49677c5f239cdfdfbedf660053011019429e312e55ad64be5070891f5465cda25cc

                                                                                                                                                          • C:\Windows\SysWOW64\SgsI.exe

                                                                                                                                                            Filesize

                                                                                                                                                            474KB

                                                                                                                                                            MD5

                                                                                                                                                            983ea25bfc4748b9667ef84dc1a56880

                                                                                                                                                            SHA1

                                                                                                                                                            3196fd9d76379fe5d93b8bee49e8e878e99d09e0

                                                                                                                                                            SHA256

                                                                                                                                                            99c46b4625de6785a5acce392272f51227000e19ff565c972aa81e61bb9f4a19

                                                                                                                                                            SHA512

                                                                                                                                                            62f3d02193168973b4bfc0a9843d9e1bb94d7025c657e8deaa7379af8e825363364b98efe524f196c2ae94f21609e478dfb1cc79740f03b556c920e8995ed0dc

                                                                                                                                                          • C:\Windows\SysWOW64\UUga.exe

                                                                                                                                                            Filesize

                                                                                                                                                            475KB

                                                                                                                                                            MD5

                                                                                                                                                            56c3fd59b15ade5cc54a525a4dc71b70

                                                                                                                                                            SHA1

                                                                                                                                                            1f42fe4382d9a6a1870f39b4cc1e297c42cb4614

                                                                                                                                                            SHA256

                                                                                                                                                            ffffa2725e09b74fa10b8d5aa37c3c2b60a41681e05f802e3085e86b0cf0e1ae

                                                                                                                                                            SHA512

                                                                                                                                                            1f044bd1afc8fe2176bc47e8ce3a9aab12143585e9da86e383b25807485bd418668b7f29fc42080a1de59bbf211af3aaa668b0e10d9301c660fa4ff7fbf475f6

                                                                                                                                                          • C:\Windows\SysWOW64\UkEW.exe

                                                                                                                                                            Filesize

                                                                                                                                                            472KB

                                                                                                                                                            MD5

                                                                                                                                                            a615d12fb58d124521483bf684e46f3d

                                                                                                                                                            SHA1

                                                                                                                                                            f4aa61f0e2b38a098c7e7db36405d478764f18e5

                                                                                                                                                            SHA256

                                                                                                                                                            bb0c3b005c956eafa3faff59b1a082c5540ba07ed412791be9a73075e6b70937

                                                                                                                                                            SHA512

                                                                                                                                                            ae883dcd1fee94dfb501d3788a5cd0b2bbd54b3eeeaad795aa24ad56ed769a6b672baf7163e4404a4939335823d360d7c1bf42431777605158542673ab552691

                                                                                                                                                          • C:\Windows\SysWOW64\WEom.exe

                                                                                                                                                            Filesize

                                                                                                                                                            479KB

                                                                                                                                                            MD5

                                                                                                                                                            c730534e92809ccba7abd829a6fe37a5

                                                                                                                                                            SHA1

                                                                                                                                                            b674b4dda957b95f9e9320021151c42b3dd6597e

                                                                                                                                                            SHA256

                                                                                                                                                            70877d6e76a7eed92fc994cde366ec7640f7957994c5228f81949e4722b37e80

                                                                                                                                                            SHA512

                                                                                                                                                            1bfe2970bfdadfaa34479439e8e61a9d6704fc5116c869997f3e924b9ce3a63229d4ab35ef40ba28d2a22c31dd359a635097e06158c821d948e5ad645355e157

                                                                                                                                                          • C:\Windows\SysWOW64\WUoC.exe

                                                                                                                                                            Filesize

                                                                                                                                                            470KB

                                                                                                                                                            MD5

                                                                                                                                                            7a8b50eb8dcd9e95009c134dc144410a

                                                                                                                                                            SHA1

                                                                                                                                                            9129abe4da4935c98491fa76c3c0488ad5679bdf

                                                                                                                                                            SHA256

                                                                                                                                                            658fa2e2d317c6cd7f2f0110e5af1c3c828289684cedfa3707cf7da4ef5efb51

                                                                                                                                                            SHA512

                                                                                                                                                            bdf11771f8fe65f20bb304586a81d1b524457177f09dbaa6bd4b6a17807d06fddbd579d8f46da8c84e35819f8d8a8708c7377e4f1ddf32261ac87ca1189119bb

                                                                                                                                                          • C:\Windows\SysWOW64\WsgK.exe

                                                                                                                                                            Filesize

                                                                                                                                                            509KB

                                                                                                                                                            MD5

                                                                                                                                                            4a446baa471dc9907d01421507cff447

                                                                                                                                                            SHA1

                                                                                                                                                            7830db80643addb54e9d06fed1a0aa91ecc70048

                                                                                                                                                            SHA256

                                                                                                                                                            cd1ebefa1604134a129b5d645ec779368700574f0fbcca505958088e9eaa139a

                                                                                                                                                            SHA512

                                                                                                                                                            f588b1a18226b857418ca99eabfc80b8d318dd7cc70193c95f78438189ed72307e66bb1069d4ba7386dc91dc9ca63647b728f4255e9a917505315fc94609f732

                                                                                                                                                          • C:\Windows\SysWOW64\WwEO.exe

                                                                                                                                                            Filesize

                                                                                                                                                            498KB

                                                                                                                                                            MD5

                                                                                                                                                            7af74720dd22a2356ab8eff9097f8b89

                                                                                                                                                            SHA1

                                                                                                                                                            c69721318bdf7e173a23f3ab1d9bfbfb6f01c71a

                                                                                                                                                            SHA256

                                                                                                                                                            c4de04e835d9ca2c436911b90aa872d0bf73ad90b97cc664de02bd4093210f21

                                                                                                                                                            SHA512

                                                                                                                                                            b541cb3a9249e40e74c40cc93abda5c882943c70f2e47a03d40edaed136041c6d703534b24bdd640bb317b967d513e59450d3882d967158ae2454800bce43b34

                                                                                                                                                          • C:\Windows\SysWOW64\YQww.exe

                                                                                                                                                            Filesize

                                                                                                                                                            475KB

                                                                                                                                                            MD5

                                                                                                                                                            55eb54b32cf7b414ec62f824553b21ed

                                                                                                                                                            SHA1

                                                                                                                                                            1bd8977e32bf27d703043d23507297d7723afbb7

                                                                                                                                                            SHA256

                                                                                                                                                            9d9c7514130fe645152c365bd186c5f7c8c063f0596a0b564c0fb08cfcce4eb6

                                                                                                                                                            SHA512

                                                                                                                                                            065a8cbead66f2f746f81736f9cdba7c12382c4ae6d03b1e67b4d6bdaf5d4ad1b751afcdcf02561c012dcf824400d56c09192090c3c9eccc8da0796979482135

                                                                                                                                                          • C:\Windows\SysWOW64\aEAC.exe

                                                                                                                                                            Filesize

                                                                                                                                                            496KB

                                                                                                                                                            MD5

                                                                                                                                                            6f455cfe5aef6b792a258ab104e145ca

                                                                                                                                                            SHA1

                                                                                                                                                            67d3c2949c1245353fb38d2ccd7ccf9880c2a784

                                                                                                                                                            SHA256

                                                                                                                                                            92b354c7628e1e39438b4d50e8c039cac050cd4626bde8bc59b4c51cb77c676d

                                                                                                                                                            SHA512

                                                                                                                                                            2c69c8d4f1b7ecee5fb475877e6836216038d33b76e5b43f7da40f737b9ec503208376a29499f5461cc70a1c178a898dd823bab504691bbb7b2b1e4f539c2bc3

                                                                                                                                                          • C:\Windows\SysWOW64\asIa.exe

                                                                                                                                                            Filesize

                                                                                                                                                            475KB

                                                                                                                                                            MD5

                                                                                                                                                            9cb5bf2f95b454d98255c747473f552e

                                                                                                                                                            SHA1

                                                                                                                                                            f6bc740077efa439714c7654f52774563ffd0cc6

                                                                                                                                                            SHA256

                                                                                                                                                            d7289209f6842d7b09ee9afad77f70dfbfdc45fce9f74426bce6a2041ca0e0d8

                                                                                                                                                            SHA512

                                                                                                                                                            63c46a07e3e07c96a40d1cf38a3bc01555bed19c3a8ecfa5fb27a367bfd7c14e0693f473e31a9c0207ecf7c3b4b13b2c387d787bb3614dd0fc966c78fce69b58

                                                                                                                                                          • C:\Windows\SysWOW64\asYW.exe

                                                                                                                                                            Filesize

                                                                                                                                                            537KB

                                                                                                                                                            MD5

                                                                                                                                                            21c3628190bb0b668e69493548cdeebe

                                                                                                                                                            SHA1

                                                                                                                                                            1d5fa412f0c217de7b52ede1c7edf9aa44ded12b

                                                                                                                                                            SHA256

                                                                                                                                                            19a43ab92c56b00e9beadee477f46d83094d40f8fb938c3e3086d689272bee8b

                                                                                                                                                            SHA512

                                                                                                                                                            500eca6c7748fb5812cf80fba7fa3df459b5200e8fea9fdd9fd7576c8575e6ab673af61c60911dca7a7fea465f15ab2f306688082a6d7c5c6d7eae62bf3c3163

                                                                                                                                                          • C:\Windows\SysWOW64\cMUy.exe

                                                                                                                                                            Filesize

                                                                                                                                                            478KB

                                                                                                                                                            MD5

                                                                                                                                                            601ea93d46583898fb1be2c26c1f7dcb

                                                                                                                                                            SHA1

                                                                                                                                                            57d36c38c8bb30a76e26f41dee57334d5b83fa8a

                                                                                                                                                            SHA256

                                                                                                                                                            f3c86d0520fcc11e62467ca4d7a5a0d1ccc355976a4848a3c030c5a94705d111

                                                                                                                                                            SHA512

                                                                                                                                                            af78b44eb32b8b243ba7e785f8b6b96c85335f2b3e70d3095184d7f56874f9e7821bd9839d14babec360f9a2ab426a6830eb111de33b1c10048cae635a0d866c

                                                                                                                                                          • C:\Windows\SysWOW64\cgQa.exe

                                                                                                                                                            Filesize

                                                                                                                                                            493KB

                                                                                                                                                            MD5

                                                                                                                                                            049023cc7147fb89ab6bb25066dcaad5

                                                                                                                                                            SHA1

                                                                                                                                                            fd48b8ac127089ae84a2de8fe2d3576c75e57a3c

                                                                                                                                                            SHA256

                                                                                                                                                            3231f3e1817e663e78b388f1408d74fa23d5f3b361ff1ff20e3df0f75866fae1

                                                                                                                                                            SHA512

                                                                                                                                                            6d4f7a61dedf5630a2d321c2523a3fe6e66f79bbb92c19e398ce3b85149deae51ba6c3e3dd2a4f5af96a3e6487a6bfce37807416f84b209a774748931f24ce8c

                                                                                                                                                          • C:\Windows\SysWOW64\coEU.exe

                                                                                                                                                            Filesize

                                                                                                                                                            474KB

                                                                                                                                                            MD5

                                                                                                                                                            8c4da847494f986703b01d9997dccf06

                                                                                                                                                            SHA1

                                                                                                                                                            8724eb315b5acf29f0451960b06fd14720a0da19

                                                                                                                                                            SHA256

                                                                                                                                                            5b91da5e78c3f14e6516f255550fc36638e4991c1019de0e5c28c99ab5533d0b

                                                                                                                                                            SHA512

                                                                                                                                                            bec022809e8fe21fb734867ea7eada4ea84da6d956495bd3c356250824b1c6a1d092dcb248e902e501164fb072280b560126295cf3ec25ff615697712c5d8c83

                                                                                                                                                          • C:\Windows\SysWOW64\eoso.ico

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            MD5

                                                                                                                                                            ee421bd295eb1a0d8c54f8586ccb18fa

                                                                                                                                                            SHA1

                                                                                                                                                            bc06850f3112289fce374241f7e9aff0a70ecb2f

                                                                                                                                                            SHA256

                                                                                                                                                            57e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563

                                                                                                                                                            SHA512

                                                                                                                                                            dfd36dff3742f39858e4a3e781e756f6d8480caa33b715ad1a8293f6ef436cdc84c3d26428230cdac8651c1ee7947b0e5bb3ac1e32c0b7bbb2bfed81375b5897

                                                                                                                                                          • C:\Windows\SysWOW64\gAIu.exe

                                                                                                                                                            Filesize

                                                                                                                                                            475KB

                                                                                                                                                            MD5

                                                                                                                                                            8a7290c087b50bef84c9f63de56e1e35

                                                                                                                                                            SHA1

                                                                                                                                                            2d575b4d5142a0e25b74b7ad754c7dfe10e92707

                                                                                                                                                            SHA256

                                                                                                                                                            89a61cf34d4026143ed27cb254f89625a630f091bd0caece8db06febf2a95b08

                                                                                                                                                            SHA512

                                                                                                                                                            8651904f57705b71b8bf601218d8ddd622d67b9a85a7298eb07fc1204b6d0ae22457c250c42fb74857607342d59bffc64941661286b9611064b5cfe9595e98ea

                                                                                                                                                          • C:\Windows\SysWOW64\gMQc.exe

                                                                                                                                                            Filesize

                                                                                                                                                            1.1MB

                                                                                                                                                            MD5

                                                                                                                                                            ed99ca261acc5a5bb14bb34d4da4a515

                                                                                                                                                            SHA1

                                                                                                                                                            e5b94d8a0229d9539fe57c0352aba1c74a405381

                                                                                                                                                            SHA256

                                                                                                                                                            adfb057653c47030c8e1d72813ab754a1c705d2eccee2cc41fe14dea875a4158

                                                                                                                                                            SHA512

                                                                                                                                                            ec4ea0dca25088c1afcd2c742d8433d158d89c2b4c0e6c9d4f12356ff253a19e63d4956bc0a5f09edace742bd57cdeb6f58682aedf79111b5dffeab9379de701

                                                                                                                                                          • C:\Windows\SysWOW64\gUIK.exe

                                                                                                                                                            Filesize

                                                                                                                                                            477KB

                                                                                                                                                            MD5

                                                                                                                                                            22f8d2b0300fac22f38b8cc1b447e7ef

                                                                                                                                                            SHA1

                                                                                                                                                            b1c5f5ab6465e3b45d990dc46495f2d7434505ce

                                                                                                                                                            SHA256

                                                                                                                                                            e7d06145de48ffe4d634db92c3556417043e555eefc551914936bbf7cb3c65a3

                                                                                                                                                            SHA512

                                                                                                                                                            6685ae77362ad0689732075af4ab44fc21948341e39dfc3df8c54c07b14f33b69040f2ff663e5e4e94b32100a9da49837ebd10a75bc21af80869bb8f44fc1253

                                                                                                                                                          • C:\Windows\SysWOW64\gkMG.exe

                                                                                                                                                            Filesize

                                                                                                                                                            473KB

                                                                                                                                                            MD5

                                                                                                                                                            514114f5426033e823f8a4ee7459523f

                                                                                                                                                            SHA1

                                                                                                                                                            b4422b0fa101a839106d8a370d6b277cc0a00fdc

                                                                                                                                                            SHA256

                                                                                                                                                            626f5f16dea7ccfa92f73ed78d342c921e4e72f181d0df10737c7582d7adbd6f

                                                                                                                                                            SHA512

                                                                                                                                                            d54a5aeff3058971b38deeeece544c5f83321ed7900023ded476ef77b92248c9f4a875a414768f5df49e9f661bf960f352e5c033bf1cba14725f2fae8bd02c18

                                                                                                                                                          • C:\Windows\SysWOW64\iIYW.exe

                                                                                                                                                            Filesize

                                                                                                                                                            1.1MB

                                                                                                                                                            MD5

                                                                                                                                                            35b67450d21d7151faf82b5a26561e5b

                                                                                                                                                            SHA1

                                                                                                                                                            d42ea89d5d9bf3b1e683b8800652532d9ed7b1a9

                                                                                                                                                            SHA256

                                                                                                                                                            314fbf1221ee8c0845507e68ee3441e58c836fad0a9492eb16ae00f22ab6a7e2

                                                                                                                                                            SHA512

                                                                                                                                                            96ebcd4cce89fb57d79a4a4c5afeb3d3dd1f149fc652ca55444d2601370903e736d4e7f0d7c41729fb135bde03bee9dffabb6de4ed616402e20276633af50437

                                                                                                                                                          • C:\Windows\SysWOW64\iMAq.exe

                                                                                                                                                            Filesize

                                                                                                                                                            473KB

                                                                                                                                                            MD5

                                                                                                                                                            fa190f9371468d20d0cc57f717d55ce0

                                                                                                                                                            SHA1

                                                                                                                                                            2c07c663f9875ea19191617f57a032533a7dadf7

                                                                                                                                                            SHA256

                                                                                                                                                            a9280a4d52eaa489e98310130d92e8cc12d4d17bc7bace2e82feaf7d129e3697

                                                                                                                                                            SHA512

                                                                                                                                                            0a840cdc324e6a253b92113f53773e27ebc82dab19c7e87c9fe0dc5739ca4dd4073b3ae34660ee7d23c4c8152b31544a3f6ce215ad7c2a1c9cd9655e0b9e4dfb

                                                                                                                                                          • C:\Windows\SysWOW64\ikwI.exe

                                                                                                                                                            Filesize

                                                                                                                                                            516KB

                                                                                                                                                            MD5

                                                                                                                                                            f94c7386ebfee305a08bb78d5b19d59a

                                                                                                                                                            SHA1

                                                                                                                                                            ce2b1fa4169567d39d4105ec2f4d52a744f44dc3

                                                                                                                                                            SHA256

                                                                                                                                                            fa0387e11f0ae63b66b67b6d0da9369216140eaa6d766c7c5657230278728e1b

                                                                                                                                                            SHA512

                                                                                                                                                            767380fd0b6dbc77e52cca29ee88a01e3e3909a98493f98694981c8bdf2ca59b35c69ed57b56c5a6f03021165ecb9a1645e4a241467e2f3640dd7f9dc6426277

                                                                                                                                                          • C:\Windows\SysWOW64\kIwe.exe

                                                                                                                                                            Filesize

                                                                                                                                                            473KB

                                                                                                                                                            MD5

                                                                                                                                                            ff849726eb3e99bfccb9cad1cea39882

                                                                                                                                                            SHA1

                                                                                                                                                            76b556e5afcdae231012bf8156ee44034b736929

                                                                                                                                                            SHA256

                                                                                                                                                            33e3ede82358f44c33bead23e553e19f001a1add8cf19e4cf83c6fd7305cf6d7

                                                                                                                                                            SHA512

                                                                                                                                                            c36067b33e15fe40859604d5a641df7548397ebbafde5e600de9369490ce8e66d75f110526efae57eef0d13b8d753fa861f87c6c416ea7cfd5f664a5a16d190b

                                                                                                                                                          • C:\Windows\SysWOW64\kMAU.exe

                                                                                                                                                            Filesize

                                                                                                                                                            1.0MB

                                                                                                                                                            MD5

                                                                                                                                                            bdc2b838f10b25ceaff893154c4973e8

                                                                                                                                                            SHA1

                                                                                                                                                            5c995426b790da6a2b48686f1a5fd75a794e4761

                                                                                                                                                            SHA256

                                                                                                                                                            6ac09f23440caaf38a00b86718d4b135742288a97625d4c30c3c8cdfa44ec99f

                                                                                                                                                            SHA512

                                                                                                                                                            dadabf3acc939224f9a3204354853f9b34ef415e6c0ec156cf0cd7eb6e983d76db5d7ffeee30007c675ff517111736a15b3ee0ea970abc365d5ddc7e293a94e9

                                                                                                                                                          • C:\Windows\SysWOW64\ksEY.exe

                                                                                                                                                            Filesize

                                                                                                                                                            925KB

                                                                                                                                                            MD5

                                                                                                                                                            5a9f4cfd061fbab081f4e3f18f69b1e1

                                                                                                                                                            SHA1

                                                                                                                                                            5e5732b251997f2bd3d97e9bcc81f515203c6705

                                                                                                                                                            SHA256

                                                                                                                                                            29d566a03a171ee25a86b328f0d2f3f2cc28e5c52da0d83b8f8e828467a419fb

                                                                                                                                                            SHA512

                                                                                                                                                            00e54ed8bcd8e8a4e27194b7ecc479fb716e42153d79fe8d7a2955ca277cb12495fd4d8c6c3a7674f130624bfa627a8000922c01e9c4db0803c286246da4c544

                                                                                                                                                          • C:\Windows\SysWOW64\kscU.exe

                                                                                                                                                            Filesize

                                                                                                                                                            475KB

                                                                                                                                                            MD5

                                                                                                                                                            ea4b15d4944dd903176cd1ebd30db0fc

                                                                                                                                                            SHA1

                                                                                                                                                            edcbe5c1fa667f8dce6ce3b6030bfcd02d9a0762

                                                                                                                                                            SHA256

                                                                                                                                                            fe6b80b80c1edba4b007257fef41f98a5485d9e3a4cf1b589d711bfd2c219975

                                                                                                                                                            SHA512

                                                                                                                                                            474b114b28758ad124c5f61ef8bc8bcec8338ff37fcf2d5f6041cb9407977b18fdb33d787b23da69915282d5fbe8211e29099f4e039a3bc8aab17392b0c3d4e5

                                                                                                                                                          • C:\Windows\SysWOW64\kwsI.exe

                                                                                                                                                            Filesize

                                                                                                                                                            476KB

                                                                                                                                                            MD5

                                                                                                                                                            fbd3bce3962d573081a42e28960c2dc9

                                                                                                                                                            SHA1

                                                                                                                                                            2051421e7b06f6bd6ace4015148b76027f153147

                                                                                                                                                            SHA256

                                                                                                                                                            6bf2612e0558da629c07dce3b031990d88926f07479ac8ec0c4e5cb8e4bc3171

                                                                                                                                                            SHA512

                                                                                                                                                            b8bf100a6067d852704e52042708426ae60ce2f6fcb1291ae9726e799b17e92ccd10093a1cad0b3540a80b4e696b8330c45aa35fe14984e831712ec6bcec5eaf

                                                                                                                                                          • C:\Windows\SysWOW64\mYMS.exe

                                                                                                                                                            Filesize

                                                                                                                                                            474KB

                                                                                                                                                            MD5

                                                                                                                                                            e48bc07d15fa29a032b49bdf292a75a7

                                                                                                                                                            SHA1

                                                                                                                                                            65ec44a8e39a50a73737bc5c87a8eb4f6ebba046

                                                                                                                                                            SHA256

                                                                                                                                                            35788afaa470c50117cd81521f12d1be730523697f5fbc757ed76bbf00d39eb1

                                                                                                                                                            SHA512

                                                                                                                                                            7fb5b82a055598a6082f68a9138e56a040281b7d648de187d71168bac7d38aa82c0477125d6669acf93536f306558db00b2b1bb6d171ff9335dbbc6e679700e2

                                                                                                                                                          • C:\Windows\SysWOW64\mcgG.exe

                                                                                                                                                            Filesize

                                                                                                                                                            1.1MB

                                                                                                                                                            MD5

                                                                                                                                                            1125e55fcb533c036ef18723b622f2ae

                                                                                                                                                            SHA1

                                                                                                                                                            00fd5c4f5f58304d1257c537621bd1a068896634

                                                                                                                                                            SHA256

                                                                                                                                                            2f4f5877d82900f50c3efa310e83af3ac5c303e9e1e9f1c4c0793f95371032a9

                                                                                                                                                            SHA512

                                                                                                                                                            b249f330c2a848d900147541fa1c8b427ce7b7514593bb73f42876b8d6d44af567a98483ef18770ac7dd3906583a2b21689ab0b1e1365d317e40c6a40ee2ef4f

                                                                                                                                                          • C:\Windows\SysWOW64\mcsO.exe

                                                                                                                                                            Filesize

                                                                                                                                                            1.1MB

                                                                                                                                                            MD5

                                                                                                                                                            87caad2f0a55c1d5b1e12f6e7e289d93

                                                                                                                                                            SHA1

                                                                                                                                                            40d65cff947a1b47fd7c4ccb6dd43432c7cbd387

                                                                                                                                                            SHA256

                                                                                                                                                            aa99c5f6240b410ddabb992b4d7eaaa371409d613284e1c92a0980a4ce7d86f3

                                                                                                                                                            SHA512

                                                                                                                                                            095d6433b6633da4764686f667fb6453e996fa3d8301a6af983ba6f840bfecaf78cd347cdd00c5d44ff8cf3f00e9820b52252bbb5490c8117fe4fbc2ef74eb87

                                                                                                                                                          • C:\Windows\SysWOW64\mgca.exe

                                                                                                                                                            Filesize

                                                                                                                                                            475KB

                                                                                                                                                            MD5

                                                                                                                                                            d4278f2556810ff0aac945f98fec357f

                                                                                                                                                            SHA1

                                                                                                                                                            75f6379b614d79359e724e940b8be0d9974d6e83

                                                                                                                                                            SHA256

                                                                                                                                                            ffbb1866e47fc072458cd6b1232021e3dc4e3daf0fac884846073cd572cafd48

                                                                                                                                                            SHA512

                                                                                                                                                            8c3fabf47e94a60cba74afb44518283d777a733bece10029bfd888408fccf5898cf90107dde327b70a0be9d9f4a2fbe208e1b2a7ffad5557c53f315031883702

                                                                                                                                                          • C:\Windows\SysWOW64\msQk.exe

                                                                                                                                                            Filesize

                                                                                                                                                            913KB

                                                                                                                                                            MD5

                                                                                                                                                            c4e102a1f78f0ec8df44a790cc9477e8

                                                                                                                                                            SHA1

                                                                                                                                                            496762d5b5517e279b544b5728578e307c628824

                                                                                                                                                            SHA256

                                                                                                                                                            4ecab730f34e965f4c820f19d048a546367781557f5e4476276aff0525ff5feb

                                                                                                                                                            SHA512

                                                                                                                                                            db51e0b70334d8bdf714aeffd08b2bf7af15a3c541cdf8710c937fdb4eab36348fcfe5f7c9940ad43f38e3a3bdee18dd5abec98c604dee4c4aab5b09144af8b4

                                                                                                                                                          • C:\Windows\SysWOW64\oYUC.exe

                                                                                                                                                            Filesize

                                                                                                                                                            478KB

                                                                                                                                                            MD5

                                                                                                                                                            937472fb583683967190306e887a6209

                                                                                                                                                            SHA1

                                                                                                                                                            fecceaa47312727e8364fa492f381daf38258f26

                                                                                                                                                            SHA256

                                                                                                                                                            aac294cfd06f663ea6acddca8fa53c97bfbb99bbeb7e2e94080cabfe1a2677cf

                                                                                                                                                            SHA512

                                                                                                                                                            f3cd598466f438f0a745a38b4f7ac7bbcea3b8ae5a996b221ed24bcbf21a48e59662abfc7977ae707c6bc5599c7ad39ac487549594c17bab46f6c7e452e0e12c

                                                                                                                                                          • C:\Windows\SysWOW64\oYwY.exe

                                                                                                                                                            Filesize

                                                                                                                                                            474KB

                                                                                                                                                            MD5

                                                                                                                                                            1d2024c9cf3fd604eb157540e96f3330

                                                                                                                                                            SHA1

                                                                                                                                                            82372e3bb0007dcf5e88296a81de1d3d255e9915

                                                                                                                                                            SHA256

                                                                                                                                                            c97db39cc8ea6946276ea9c995db3a7673bbc24c479d191939d7333c9949a884

                                                                                                                                                            SHA512

                                                                                                                                                            46ce88ad78ac7a42836214839ab1642fd643d13bd82cdbc6940d6c9a2039790e26cb4ef8f60b0bf053b860c04b245240d0a4de18394492292aae5d7c96c12c44

                                                                                                                                                          • C:\Windows\SysWOW64\oscm.exe

                                                                                                                                                            Filesize

                                                                                                                                                            479KB

                                                                                                                                                            MD5

                                                                                                                                                            6c62744f1d1ca1af750d9cce3172ecec

                                                                                                                                                            SHA1

                                                                                                                                                            d12c1fc47151092e88eb764a02fed9b9fcb2a225

                                                                                                                                                            SHA256

                                                                                                                                                            116a9c295824c8bcbfeb1fbe1c25565af546c51536a7c3fef09ee571874e7348

                                                                                                                                                            SHA512

                                                                                                                                                            069922bbc0a1d7ecd548bab3f51cbc030aada5e49dc17fdce016b60a9c520e9d2cfa19f30414f0a5c0300e4ee3a15c93743bcb0210113481d753fab58ab577d1

                                                                                                                                                          • C:\Windows\SysWOW64\qAQu.exe

                                                                                                                                                            Filesize

                                                                                                                                                            483KB

                                                                                                                                                            MD5

                                                                                                                                                            0d0b5a7fb02ead58f104f16125fadbf6

                                                                                                                                                            SHA1

                                                                                                                                                            09e9d542130fbdd50008d1447b308cda18083b07

                                                                                                                                                            SHA256

                                                                                                                                                            7e118241b3fe8cba82e9ecc131b225dcfc8f191eb4738935e37e43b67aabc53d

                                                                                                                                                            SHA512

                                                                                                                                                            4934d5697a13aa5a23ff99f713e426feace3458db70e0d4e5a7f26cf8765174be3feae64b84683062a046b67e147f39547ed43d656c9843bead233a39bbe8fbc

                                                                                                                                                          • C:\Windows\SysWOW64\qEsy.exe

                                                                                                                                                            Filesize

                                                                                                                                                            478KB

                                                                                                                                                            MD5

                                                                                                                                                            41aac84f483a7426e8047521062d1de3

                                                                                                                                                            SHA1

                                                                                                                                                            0e8be7956a2547c968e16daa670568b1d23cb82c

                                                                                                                                                            SHA256

                                                                                                                                                            87c43851b5e536e36660fdb5b7d47dd789505f7f5e84a353ae4e91904462e118

                                                                                                                                                            SHA512

                                                                                                                                                            18f0e3db28c55aa852240c02f7e71a90b26b85bb0e52de784775ac948689c190bbb00eeebba5c7f0106c5de737f4e3f8ea0b3f4ddfd75798c14b6791476ea615

                                                                                                                                                          • C:\Windows\SysWOW64\qMUo.exe

                                                                                                                                                            Filesize

                                                                                                                                                            478KB

                                                                                                                                                            MD5

                                                                                                                                                            86b0d6f04c3a00aa558b2f6c73601e87

                                                                                                                                                            SHA1

                                                                                                                                                            ea99372b2505a229a663e2ae40702156f958c713

                                                                                                                                                            SHA256

                                                                                                                                                            271d265e9e3815fa5ddf19f3ed1aafaedd8e632deec502c9f48d343ab930d5b6

                                                                                                                                                            SHA512

                                                                                                                                                            36853c29e73f10ec528291d1816ba5b430571068c2fa8d989c0bcb70d7c2d5c5dcff26be54e77e3682935c321e7db38ad3daef22717d721625ad1a2794e2fdd3

                                                                                                                                                          • C:\Windows\SysWOW64\qYkK.exe

                                                                                                                                                            Filesize

                                                                                                                                                            2.0MB

                                                                                                                                                            MD5

                                                                                                                                                            f03e4b1e576abf053550cfa89b056b10

                                                                                                                                                            SHA1

                                                                                                                                                            2a1d5cea27abe0df2958f19441ed62f65b5d8120

                                                                                                                                                            SHA256

                                                                                                                                                            8f573382b2e25e43a7e54cda9b6c53d528c45bedd9a58b9dc6f15b1b2186205d

                                                                                                                                                            SHA512

                                                                                                                                                            14f6ebab40957cb81dd52609737b9e1104b88a9c4b586235342778d7d8c5c78085b76a7b62846b0cabac2ae1b54a58e73ccaad720277d9c68ec265414142478f

                                                                                                                                                          • C:\Windows\SysWOW64\qYko.exe

                                                                                                                                                            Filesize

                                                                                                                                                            472KB

                                                                                                                                                            MD5

                                                                                                                                                            434934988fb040ea969c002e37040400

                                                                                                                                                            SHA1

                                                                                                                                                            31dac883189360ef76f77a01b0c99efd1e1bcacd

                                                                                                                                                            SHA256

                                                                                                                                                            fb6fd96070d91dd32dd29278f97c59d6b758e3840bea0edf5a9b4ed518573d28

                                                                                                                                                            SHA512

                                                                                                                                                            11df826b5b8e243a09bda9e5425226a798258c0f680568d869edbc248671eeccbd718a7806fcb0d55f8bfdad9dacccb9dca18d4f0e91d930f5d24b19e3750f8a

                                                                                                                                                          • C:\Windows\SysWOW64\qgYG.exe

                                                                                                                                                            Filesize

                                                                                                                                                            914KB

                                                                                                                                                            MD5

                                                                                                                                                            245b5bf5dc80f644dc6345c6f28ffb11

                                                                                                                                                            SHA1

                                                                                                                                                            9f1681c2793b8f48a8abf3daf981400659dcb542

                                                                                                                                                            SHA256

                                                                                                                                                            89b3c23708bbc6f7af35ab70e60ca5cb3de7fa162cca1c973559f5fb899ad5b5

                                                                                                                                                            SHA512

                                                                                                                                                            ab128511b5c35a7357ada0f367f25729159c5d99118a2a1adb1014cc94e35281108d55af7bfd3bb27bbb104a20d809161b90bec25306bf30f380cfa17eb989bd

                                                                                                                                                          • C:\Windows\SysWOW64\qkUY.exe

                                                                                                                                                            Filesize

                                                                                                                                                            844KB

                                                                                                                                                            MD5

                                                                                                                                                            a5c6bc1ce460b8d68f0972fecce92e35

                                                                                                                                                            SHA1

                                                                                                                                                            491784b2d735f274672848e48c192e876a662609

                                                                                                                                                            SHA256

                                                                                                                                                            fa8acb88475a751d420771ffe4ee8c4fe3118e0959598cb8cd381fcc2fd12fb5

                                                                                                                                                            SHA512

                                                                                                                                                            5484d60aa02d42f17f8411f41d1d1e53a56681e336a7c9d8c8e6d9978602f13958302978d1da03ae4e544d09da410ed5b4b07f4577c7e31a031122b3f5bea2fb

                                                                                                                                                          • C:\Windows\SysWOW64\qsgu.exe

                                                                                                                                                            Filesize

                                                                                                                                                            479KB

                                                                                                                                                            MD5

                                                                                                                                                            9bb3f57565a234b501b53b7164874e38

                                                                                                                                                            SHA1

                                                                                                                                                            cfcc083c1290fea424bef9efa6d45367b98537b7

                                                                                                                                                            SHA256

                                                                                                                                                            28cc4fefe6910a1ce3b470d7a9551894abecf3dffcfdb2d841235a599eb078e8

                                                                                                                                                            SHA512

                                                                                                                                                            2e998a967d59f70861c49d6d0c648387a0c9943f46b9de6557fed06b6475611c56a0efa7d2c16ab2eb905ada6f5dd64a62ede952d0760044f6a67eccd0e8433f

                                                                                                                                                          • C:\Windows\SysWOW64\sQEo.exe

                                                                                                                                                            Filesize

                                                                                                                                                            489KB

                                                                                                                                                            MD5

                                                                                                                                                            4a82ffce1d88aea58c105e1e0f6652c9

                                                                                                                                                            SHA1

                                                                                                                                                            9fec34ab257735d71b6767d9c4b7a1950444e4f7

                                                                                                                                                            SHA256

                                                                                                                                                            3f507ff2ecfefb98b2641a3b694b29133fe80ed70871511029a1a5f7b4f6410d

                                                                                                                                                            SHA512

                                                                                                                                                            808a39bacc19c167504acaa5e9ca0d49a9cd857e0a86a1f3729c427b1176ff8522aa6dfa0b1c09020eeeaecae875cf2b1e9036177a581f796c9425b56702c61c

                                                                                                                                                          • C:\Windows\SysWOW64\skYS.exe

                                                                                                                                                            Filesize

                                                                                                                                                            476KB

                                                                                                                                                            MD5

                                                                                                                                                            b8d0022f38da039a917f9d0f5a7ab4bc

                                                                                                                                                            SHA1

                                                                                                                                                            f73da0b8e2a34488786d1a30fa5c51475ce13998

                                                                                                                                                            SHA256

                                                                                                                                                            c274ce86aa84c42c1fbb38059ca292132131391f4c86ff487ed2ca3eb7abd20f

                                                                                                                                                            SHA512

                                                                                                                                                            7fa1400f32741f76cd1a63bb78dac2fad223814ad04f521f6a542fd28b25c0496a75f6be79d0753ddcc825e82b70b7d9fe9bef956951b4e898a281823de218bc

                                                                                                                                                          • C:\Windows\SysWOW64\uAIi.exe

                                                                                                                                                            Filesize

                                                                                                                                                            479KB

                                                                                                                                                            MD5

                                                                                                                                                            b9d02fba785bbc5eb84719ba43f335e1

                                                                                                                                                            SHA1

                                                                                                                                                            778c6c0a373aebfc9290d9e91fd257e164a7be35

                                                                                                                                                            SHA256

                                                                                                                                                            a289193f45870526a888133c0c6b91ac8674cf84df9fe5a058e48f181bc6c907

                                                                                                                                                            SHA512

                                                                                                                                                            2fa49a502412ec8a555ee9599455a29867018cb05afa3a65675610eef32bd2635e589979ee4f15a42fee3877b6f7f3aece6b72e45a4478371311ca23c9674d16

                                                                                                                                                          • C:\Windows\SysWOW64\uYUe.exe

                                                                                                                                                            Filesize

                                                                                                                                                            599KB

                                                                                                                                                            MD5

                                                                                                                                                            1400f66850db138b8286da28ce67675c

                                                                                                                                                            SHA1

                                                                                                                                                            2c5e797954f79e6ee6aaa2c7722cc3da2dbc3d3d

                                                                                                                                                            SHA256

                                                                                                                                                            bcce830891259036ae8b339b8e5130dd160477d0c0927349cf7f9115b5fae81a

                                                                                                                                                            SHA512

                                                                                                                                                            5b1707f0ee68eccad1303cada340292714519962521d98c97fcbd67c3adb4844f679c89524c704a6b2b44d04e68a8798cd0dbcc514bb8ac1f6d246283d54dd30

                                                                                                                                                          • C:\Windows\SysWOW64\ucAa.exe

                                                                                                                                                            Filesize

                                                                                                                                                            474KB

                                                                                                                                                            MD5

                                                                                                                                                            6dec97e1843af358ea797385a1ed87fd

                                                                                                                                                            SHA1

                                                                                                                                                            785bac9c56a34cdc59936eb66c709780ca9bd11a

                                                                                                                                                            SHA256

                                                                                                                                                            8568328faa420c5d78940e5d7d5d24751b014ca7dbf97f7dd010784e5ab677b7

                                                                                                                                                            SHA512

                                                                                                                                                            bed8a7fe0d922cb43fe4eeb48c8a940ea0083d127df2a7b25c4d45523d93642c1f29e0a6879999a9614d3bbf7d4348ea351b2c7ad947f173f57c013a1c588ca9

                                                                                                                                                          • C:\Windows\SysWOW64\ukka.exe

                                                                                                                                                            Filesize

                                                                                                                                                            473KB

                                                                                                                                                            MD5

                                                                                                                                                            3fe80aab718032ee296ca787b9a73c82

                                                                                                                                                            SHA1

                                                                                                                                                            7e9b883d3f4b4a8f95b91d249737ea3399018a55

                                                                                                                                                            SHA256

                                                                                                                                                            008abf741387e52ba9f76072588da0f701d90cc12d2faee3bc044efa795fbc99

                                                                                                                                                            SHA512

                                                                                                                                                            bc52062ded1a85a540a9361dfb68cdb3668d1e654815874878a34dcdfedf12490c2154f693f5cdb8593d16cce3318c80dcabde45e0d2c6868457922dc1fae65b

                                                                                                                                                          • C:\Windows\SysWOW64\wIQo.exe

                                                                                                                                                            Filesize

                                                                                                                                                            1.0MB

                                                                                                                                                            MD5

                                                                                                                                                            986a6f0485d38900183abe8a14a68d7d

                                                                                                                                                            SHA1

                                                                                                                                                            a0f2981a0aa14327aafe186d3c6281dc7ea16805

                                                                                                                                                            SHA256

                                                                                                                                                            eaa9978dc53c0764a5ff0620ee85b3d1f7ad57a5471ecb2fd0b94cb0ff05f112

                                                                                                                                                            SHA512

                                                                                                                                                            14420bcdc3ef3ba7e351f374f44292945335831893a5a7cc81ac018422fdde376e31b0da8fef9e9a8ccbd0b7297536e4304dbc4c8f00a56fe08e01c0170f484e

                                                                                                                                                          • C:\Windows\SysWOW64\wowa.exe

                                                                                                                                                            Filesize

                                                                                                                                                            704KB

                                                                                                                                                            MD5

                                                                                                                                                            5639f73e1c14dfffc4ec87eaf5b29a7c

                                                                                                                                                            SHA1

                                                                                                                                                            3e4dde6770453a2848f7c9c28d3de68c9fe6a339

                                                                                                                                                            SHA256

                                                                                                                                                            75556a72af6323a525d999cfefff12daefb86c5abfde325ea38825bcf3459507

                                                                                                                                                            SHA512

                                                                                                                                                            96e3bf026e92a31ed9f956d5407ce13e79d818249bef8fe43117bac960d65bba81e221d326fd806c29cad2e7bdb5bf3f6f3ce3fae1994f7f1a5d22df0748c0e6

                                                                                                                                                          • C:\Windows\SysWOW64\yUkc.exe

                                                                                                                                                            Filesize

                                                                                                                                                            474KB

                                                                                                                                                            MD5

                                                                                                                                                            3b5aa19ad8a3e439ec617ae7cb7e7baa

                                                                                                                                                            SHA1

                                                                                                                                                            769a9296fef00835d3f494d42053390b24499360

                                                                                                                                                            SHA256

                                                                                                                                                            4b36c83dc16859d7d1a6b89d39e6aa4e5a89af87305e5984e1389d888039c813

                                                                                                                                                            SHA512

                                                                                                                                                            2e487ebd3ffa264ebfcb2151bece50a5208efcca910b9de7060b900d02eb188b778b3c45421a1a2372d045209715d165a7f9555c61a6b167df9c4efcac3a9c52

                                                                                                                                                          • C:\Windows\SysWOW64\yoUg.exe

                                                                                                                                                            Filesize

                                                                                                                                                            473KB

                                                                                                                                                            MD5

                                                                                                                                                            c07deb8a7b9d55ecece6fa70a4794b1f

                                                                                                                                                            SHA1

                                                                                                                                                            03d9b4bf69f16e38c2eabddfa9fc1385cd4d5723

                                                                                                                                                            SHA256

                                                                                                                                                            b15691e7dad7c85e0b53a6700f0073b739ed97f66ac8ef959203b189e04ba15b

                                                                                                                                                            SHA512

                                                                                                                                                            ed64aca521563645697af6095b13e798bdf9c6aae5a668626ad250f5bb8e26bb5333936968520da21534fcaba7126f6edc5165444b595c1817cfcb5ef022ca1d

                                                                                                                                                          • C:\Windows\SysWOW64\yoco.exe

                                                                                                                                                            Filesize

                                                                                                                                                            1.1MB

                                                                                                                                                            MD5

                                                                                                                                                            2e5248d842e522ae3aef53e782dd1832

                                                                                                                                                            SHA1

                                                                                                                                                            228bec46a14a2bf81bb2680b7fecda5a43b7faae

                                                                                                                                                            SHA256

                                                                                                                                                            4cade649048bbc58b70aaecda144115d9f2bb64b1e21dd8f5e1cb980a869dd5c

                                                                                                                                                            SHA512

                                                                                                                                                            02d30eb5daa87a19ddc0b5631667b7111c2c13edb8724b15ac56220e085d80961b620d93b58ca03a20a318e1c099e4a4c464be3b21f2878dc679f2e335a4b953

                                                                                                                                                          • C:\Windows\SysWOW64\ywYC.exe

                                                                                                                                                            Filesize

                                                                                                                                                            475KB

                                                                                                                                                            MD5

                                                                                                                                                            af5e99def3d1c56c2240c6927b7a6da6

                                                                                                                                                            SHA1

                                                                                                                                                            6791b174b172cb4bac093897909d801db57ef1d2

                                                                                                                                                            SHA256

                                                                                                                                                            2eed280cfd6bccd5fe71d8eb1a9017305e332f5c965cb996836f4b21f47fb191

                                                                                                                                                            SHA512

                                                                                                                                                            5d6f501635b55657723e8c19a46102fbb15cbf443351007ca6099d3fb87bbd4088ff708aee63589ad4bf611106969950a930b9637030f3d8439745113e8ccf81

                                                                                                                                                          • memory/3304-0-0x0000000000401000-0x0000000000475000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            464KB

                                                                                                                                                          • memory/3304-141-0x0000000000401000-0x0000000000475000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            464KB

                                                                                                                                                          • memory/3924-899-0x0000000000400000-0x0000000000479000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            484KB

                                                                                                                                                          • memory/3924-6-0x0000000000400000-0x0000000000479000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            484KB