Analysis
- max time kernel
61s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 21:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Worm.MSIL.Agent.ck.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Worm.MSIL.Agent.ck.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target jaffacakes118_Worm.MSIL.Agent.ck.exe
- Size 47KB
- Sample261012-1d9gnafv7x
- SHA256 c629d8e262df5ef3aa4b746a31ecd13b3c2cf25fe1e9eb79c11307290abd624a
- MD5 519919996a67da574df203d95c758813
- SHA1 a339fbc8fdabc89cf70f3151f3e84b70d764e98a
- SHA512 70d0eb6cd3ae98b81dc615a43f66e77afd37362802cf82b4ea3861399358e3cbaee8c58bb556e127842d821a98e348e4b07dd4ca0ed6111bab1203d9d7482e97
- SSDEEP 768:Mta3TaUO7KFdj/xcWByv8s3i6E5nXfUWPYfIc/Qi3qEBQp:uaWA/x3s3i6EBXlLOUp
- TLSH T19223182673C8CBA3D16E27705442A62007B1ED366656DBCB3D81B98F5DF13808772F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Drivers\Drivers.exe jaffacakes118_Worm.MSIL.Agent.ck.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\ca-ES-valencia32\ca-ES-valencia.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\fil-PH32\fil-PH.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\ms-MY32\ms-MY.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\ru-RU32\ru-RU.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\SecurityHealth32\SecurityHealth.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\ta-IN32\ta-IN.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\ar-SA\ar-SA.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\chr-CHER-US\chr-CHER-US.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\AppLocker32\AppLocker.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\be-BY32\be-BY.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\Recovery32\Recovery.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\zh-TW32\zh-TW.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\is-IS\is-IS.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\mi-NZ\mi-NZ.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\or-IN\or-IN.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\pt-BR\pt-BR.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\ias32\ias.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\PerceptionSimulation32\PerceptionSimulation.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\sv-SE32\sv-SE.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\tr-TR32\tr-TR.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\hr-HR\hr-HR.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\id-ID\id-ID.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\oobe\oobe.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\bn-IN32\bn-IN.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\fi-FI32\fi-FI.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\gu-IN32\gu-IN.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\WDI32\WDI.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\it32\it.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\az-Latn-AZ\az-Latn-AZ.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\MailContactsCalendarSync\MailContactsCalendarSync.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\RasToast\RasToast.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\te-IN\te-IN.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\kok-IN32\kok-IN.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\lv-LV32\lv-LV.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\eu-ES\eu-ES.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\lv-LV\lv-LV.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\spp\spp.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\az-Latn-AZ32\az-Latn-AZ.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\eu-ES32\eu-ES.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\kn-IN32\kn-IN.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\uk-UA\uk-UA.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\WinMetadata\WinMetadata.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\Printing_Admin_Scripts32\Printing_Admin_Scripts.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\sl-SI32\sl-SI.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\hi-IN\hi-IN.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\Nui32\Nui.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\cs-CZ\cs-CZ.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\it\it.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\040932\0409.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\AdvancedInstallers32\AdvancedInstallers.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\Ipmi32\Ipmi.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\it-IT\it-IT.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\Licenses\Licenses.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\sr-Latn-RS\sr-Latn-RS.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\DriverState32\DriverState.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\fr-FR32\fr-FR.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\ml-IN32\ml-IN.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\slmgr32\slmgr.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\LogFiles\LogFiles.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\is-IS32\is-IS.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\migwiz32\migwiz.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\System32\UNP32\UNP.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\hy-AM\hy-AM.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\SysWOW64\MSDRM\MSDRM.exe jaffacakes118_Worm.MSIL.Agent.ck.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Photo Viewer\es-ES\es-ES.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\de-DE.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Program Files.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Microsoft Office\Microsoft Office.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Microsoft (x86)\Microsoft.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\uk-UA Advanced Threat Protection\uk-UA.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Windows Media Player\Icons\Icons.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\Configuration.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\WindowsApps\MovedPackages\MovedPackages.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\logs.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\ja-JP.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Windows Photo Viewer\it-IT\it-IT.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\WindowsPowerShell\WindowsPowerShell.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Windows NT (x86)\Windows NT.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Windows Sidebar (x86)\Windows Sidebar.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Microsoft Office 15\ClientX64 15\ClientX64.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Reference Assemblies\Microsoft\Microsoft.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Windows NT\TableTextService\TableTextService.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Windows Photo Viewer\en-US\en-US.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\VideoLAN\VideoLAN.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Microsoft Office\PackageManifests\PackageManifests.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\WindowsApps\Merged\Merged.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Microsoft Shared.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Windows NT\Windows NT.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Adobe (x86)\Adobe.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Mozilla Firefox\browser\browser.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\VideoLAN\VLC\VLC.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\de-DE Advanced Threat Protection\de-DE.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\it-IT Advanced Threat Protection\it-IT.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\fr-FR.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Gadgets.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Windows Photo Viewer (x86)\Windows Photo Viewer.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\gmp-clearkey.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Windows Media Player\es-ES\es-ES.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\EdgeUpdate_bk.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies.NET\Primary Interop Assemblies.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Windows Media Player\ja-JP\ja-JP.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Windows NT\Accessories\Accessories.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Shared Gadgets.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Program Files (x86).exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\WindowsApps\Deleted\Deleted.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Acrobat Reader DC.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Microsoft\Temp\Temp.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\en-US.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Windows Mail\Windows Mail.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Mozilla Firefox\Mozilla Firefox.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Reference Assemblies (x86)\Reference Assemblies.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Mozilla Firefox\defaults\defaults.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Windows NT\Accessories\Accessories.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\WindowsApps\Projected\Projected.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\EdgeUpdate_disable.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\fr-FR.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Internet Explorer\es-ES\es-ES.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Microsoft Office\Office16\Office16.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\en-US Advanced Threat Protection\en-US.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR Advanced Threat Protection\fr-FR.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\WindowsApps\MutableBackup\MutableBackup.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Common Files\Oracle\Oracle.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files (x86)\Windows Defender\fr-FR\fr-FR.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Internet Explorer\de-DE\de-DE.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Program Files\Mozilla Firefox\uninstall\uninstall.exe jaffacakes118_Worm.MSIL.Agent.ck.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-onecore-w..fense-adm.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_abcac14539620961\amd64_microsoft-onecore-w..fense-adm.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_abcac14539620961.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ompat-adm.resources_31bf3856ad364e35_10.0.26100.1_en-us_65dd563af9f75ded\amd64_microsoft-windows-d..ompat-adm.resources_31bf3856ad364e35_10.0.26100.1_en-us_65dd563af9f75ded.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_lt-lt_757d9768111682fd\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_lt-lt_757d9768111682fd.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..o-multi-dimensional_31bf3856ad364e35_10.0.26100.1150_none_ba8e3b5655dbffee\amd64_microsoft-windows-m..o-multi-dimensional_31bf3856ad364e35_10.0.26100.1150_none_ba8e3b5655dbffee.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.26100.1591_chr..-us_6bb777be5959518c\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.26100.1591_chr..-us_6bb777be5959518c.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..in.deploy.resources_31bf3856ad364e35_10.0.26100.1_en-us_a7205bbd6d508a55\amd64_microsoft-windows-d..in.deploy.resources_31bf3856ad364e35_10.0.26100.1_en-us_a7205bbd6d508a55.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_c_swcomponent.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_32c14cc7c4efa369\amd64_c_swcomponent.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_32c14cc7c4efa369.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_ddores.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_882fe26296b6864e\amd64_ddores.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_882fe26296b6864e.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ging-task.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_72fa2877327a8e6d\amd64_microsoft-windows-d..ging-task.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_72fa2877327a8e6d.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ybinaries.resources_31bf3856ad364e35_10.0.26100.1_de-de_60f3b24136de5299\amd64_microsoft-windows-i..ybinaries.resources_31bf3856ad364e35_10.0.26100.1_de-de_60f3b24136de5299.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..skfactory.resources_31bf3856ad364e35_10.0.26100.1_it-it_18031ce85c348031\amd64_microsoft-windows-r..skfactory.resources_31bf3856ad364e35_10.0.26100.1_it-it_18031ce85c348031.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..resources.resources_31bf3856ad364e35_10.0.26100.1_es-es_0339abe812c92669\amd64_microsoft-windows-s..resources.resources_31bf3856ad364e35_10.0.26100.1_es-es_0339abe812c92669.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..libraries.resources_31bf3856ad364e35_10.0.26100.1_it-it_0612f5ea41ebae9b\amd64_microsoft-windows-t..libraries.resources_31bf3856ad364e35_10.0.26100.1_it-it_0612f5ea41ebae9b.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a...appxmain.resources_31bf3856ad364e35_10.0.26100.1_en-us_338e5fb4da7a0b72\amd64_microsoft-windows-a...appxmain.resources_31bf3856ad364e35_10.0.26100.1_en-us_338e5fb4da7a0b72.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_c_fshsm.inf.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_d09207407bb88862\amd64_c_fshsm.inf.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_d09207407bb88862.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.26100.1_de-de_e185954d081e424b\amd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.26100.1_de-de_e185954d081e424b.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ols-klist.resources_31bf3856ad364e35_10.0.26100.1_it-it_b6ec6c7109e302a5\amd64_microsoft-windows-s..ols-klist.resources_31bf3856ad364e35_10.0.26100.1_it-it_b6ec6c7109e302a5.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.26100.1591_be-by_6dcc541b361fdc03\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.26100.1591_be-by_6dcc541b361fdc03.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_pnpxassocprx.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_e4ac62a9ad854f2f\amd64_pnpxassocprx.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_e4ac62a9ad854f2f.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_vhdmp.inf.resources_31bf3856ad364e35_10.0.26100.1591_en-us_86287e5968faca1a\amd64_vhdmp.inf.resources_31bf3856ad364e35_10.0.26100.1591_en-us_86287e5968faca1a.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_c_fsundelete.inf.resources_31bf3856ad364e35_10.0.26100.1_it-it_81783b18cfecf4aa\amd64_c_fsundelete.inf.resources_31bf3856ad364e35_10.0.26100.1_it-it_81783b18cfecf4aa.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-korean-hanjadic_31bf3856ad364e35_10.0.26100.1591_none_96b9dbf9be21a531\amd64_microsoft-windows-ime-korean-hanjadic_31bf3856ad364e35_10.0.26100.1591_none_96b9dbf9be21a531.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..interface.resources_31bf3856ad364e35_10.0.26100.1_de-de_502519ca04c98dca\amd64_microsoft-windows-t..interface.resources_31bf3856ad364e35_10.0.26100.1_de-de_502519ca04c98dca.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_system.threading.tasks_b03f5f7f11d50a3a_4.0.15912.0_none_a1fd3128fc9ac5c7\amd64_system.threading.tasks_b03f5f7f11d50a3a_4.0.15912.0_none_a1fd3128fc9ac5c7.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_system.web.abstractions_31bf3856ad364e35_4.0.15912.0_none_7a6449893b418c12\amd64_system.web.abstractions_31bf3856ad364e35_4.0.15912.0_none_7a6449893b418c12.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\msil_microsoft.windows.s...commands.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_fa42a298595641a3\msil_microsoft.windows.s...commands.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_fa42a298595641a3.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\msil_multipoint-wmsusertab.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_1c142c98a48e9df1\msil_multipoint-wmsusertab.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_1c142c98a48e9df1.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_dual_c_swcomponent.inf_31bf3856ad364e35_10.0.26100.1_none_8fe47a006913610a\amd64_dual_c_swcomponent.inf_31bf3856ad364e35_10.0.26100.1_none_8fe47a006913610a.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tbranding.resources_31bf3856ad364e35_11.0.26100.1_de-de_7e3306a7ebc87c27\amd64_microsoft-windows-i..tbranding.resources_31bf3856ad364e35_11.0.26100.1_de-de_7e3306a7ebc87c27.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..r-library.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_74529ea9666cc841\amd64_microsoft-windows-l..r-library.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_74529ea9666cc841.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spp-main.resources_31bf3856ad364e35_10.0.26100.1_es-es_bd743fc5c27aaede\amd64_microsoft-windows-spp-main.resources_31bf3856ad364e35_10.0.26100.1_es-es_bd743fc5c27aaede.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wlansvc.resources_31bf3856ad364e35_10.0.26100.1_de-de_91c85c620fc97171\amd64_microsoft-windows-wlansvc.resources_31bf3856ad364e35_10.0.26100.1_de-de_91c85c620fc97171.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpdui.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_a0993f64b4754fa3\amd64_microsoft-windows-wmpdui.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_a0993f64b4754fa3.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_10.0.26100.1_none_e440080db8d82fa1\amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_10.0.26100.1_none_e440080db8d82fa1.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_presentationframework.resources_31bf3856ad364e35_4.0.15912.0_ja-jp_923f3f62ed0107cf\amd64_presentationframework.resources_31bf3856ad364e35_4.0.15912.0_ja-jp_923f3f62ed0107cf.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_disk.inf.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_323a933909855cdf\amd64_disk.inf.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_323a933909855cdf.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..brokeredapi-desktop_31bf3856ad364e35_10.0.26100.1150_none_64189304452a1e6d\amd64_microsoft-windows-c..brokeredapi-desktop_31bf3856ad364e35_10.0.26100.1150_none_64189304452a1e6d.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eapttlsext.resources_31bf3856ad364e35_10.0.26100.1_es-es_cfa9f28e37fbdda7\amd64_microsoft-windows-eapttlsext.resources_31bf3856ad364e35_10.0.26100.1_es-es_cfa9f28e37fbdda7.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..timezones.resources_31bf3856ad364e35_10.0.26100.1_it-it_0d13c394b47e0daa\amd64_microsoft-windows-i..timezones.resources_31bf3856ad364e35_10.0.26100.1_it-it_0d13c394b47e0daa.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-propsys.resources_31bf3856ad364e35_7.0.26100.1455_en-us_a4bbb067e18a69da\amd64_microsoft-windows-propsys.resources_31bf3856ad364e35_7.0.26100.1455_en-us_a4bbb067e18a69da.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-store-adm.resources_31bf3856ad364e35_10.0.26100.1_de-de_f562890514e60cc5\amd64_microsoft-windows-store-adm.resources_31bf3856ad364e35_10.0.26100.1_de-de_f562890514e60cc5.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\msil_aspnetmmcext_b03f5f7f11d50a3a_10.0.26100.1_none_24b838284a1ae57b\msil_aspnetmmcext_b03f5f7f11d50a3a_10.0.26100.1_none_24b838284a1ae57b.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\msil_iehost_b03f5f7f11d50a3a_10.0.26100.1_none_2299394fbb98cb76\msil_iehost_b03f5f7f11d50a3a_10.0.26100.1_none_2299394fbb98cb76.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\Boot\DVD\DVD.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_dual_c_avc.inf_31bf3856ad364e35_10.0.26100.1_none_53e58b8e9c4ea5e1\amd64_dual_c_avc.inf_31bf3856ad364e35_10.0.26100.1_none_53e58b8e9c4ea5e1.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_dual_nvdimm.inf_31bf3856ad364e35_10.0.26100.1150_none_fe6706a6bdd5ec52\amd64_dual_nvdimm.inf_31bf3856ad364e35_10.0.26100.1150_none_fe6706a6bdd5ec52.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_hyperv-sbresources_31bf3856ad364e35_10.0.26100.1_none_748c11ff27732349\amd64_hyperv-sbresources_31bf3856ad364e35_10.0.26100.1_none_748c11ff27732349.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.26100.1591_none_3f2e181ddb9e8c83\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.26100.1591_none_3f2e181ddb9e8c83.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_wvms_mp_windows.inf.resources_31bf3856ad364e35_10.0.26100.1_de-de_af2278bb8d223e1c\amd64_wvms_mp_windows.inf.resources_31bf3856ad364e35_10.0.26100.1_de-de_af2278bb8d223e1c.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..agnostics.resources_31bf3856ad364e35_10.0.26100.1_it-it_ddd56d08edcb22ac\msil_microsoft.powershel..agnostics.resources_31bf3856ad364e35_10.0.26100.1_it-it_ddd56d08edcb22ac.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-onecoreuap-deviceaccess_31bf3856ad364e35_10.0.26100.1150_none_89ff0bc915b54e6f\amd64_microsoft-onecoreuap-deviceaccess_31bf3856ad364e35_10.0.26100.1150_none_89ff0bc915b54e6f.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nager-adm.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_7bbdb0ad736ed7ab\amd64_microsoft-windows-a..nager-adm.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_7bbdb0ad736ed7ab.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_a1fb195e6230f8f1\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_a1fb195e6230f8f1.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..indetails.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_25a3e154eb9d25c8\amd64_microsoft-windows-h..indetails.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_25a3e154eb9d25c8.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysinfo.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_03cdd69f7d734f30\amd64_microsoft-windows-sysinfo.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_03cdd69f7d734f30.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wlanpref.resources_31bf3856ad364e35_10.0.26100.1_it-it_7e6a5f6f1a27cb58\amd64_microsoft-windows-wlanpref.resources_31bf3856ad364e35_10.0.26100.1_it-it_7e6a5f6f1a27cb58.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_netfx4-clr_dll_b03f5f7f11d50a3a_4.0.15912.365_none_398819924c6d0e60\amd64_netfx4-clr_dll_b03f5f7f11d50a3a_4.0.15912.365_none_398819924c6d0e60.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_system.diagnostics.fileversioninfo_b03f5f7f11d50a3a_4.0.15912.0_none_1f33140151475e2d\amd64_system.diagnostics.fileversioninfo_b03f5f7f11d50a3a_4.0.15912.0_none_1f33140151475e2d.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..core-task.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_ffba70e949713630\amd64_microsoft-windows-e..core-task.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_ffba70e949713630.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_fcf0c8c9864854e9\amd64_microsoft-windows-lpksetup.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_fcf0c8c9864854e9.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tooth-hfp.resources_31bf3856ad364e35_10.0.26100.1_it-it_c0549974aba4849e\amd64_microsoft-windows-o..tooth-hfp.resources_31bf3856ad364e35_10.0.26100.1_it-it_c0549974aba4849e.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupcl.resources_31bf3856ad364e35_10.0.26100.1_es-es_970de6964fab709b\amd64_microsoft-windows-setupcl.resources_31bf3856ad364e35_10.0.26100.1_es-es_970de6964fab709b.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.26100.1_it-it_ed608e18ad93b3b1\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.26100.1_it-it_ed608e18ad93b3b1.exe jaffacakes118_Worm.MSIL.Agent.ck.exe File created C:\Windows\WinSxS\amd64_uiautomationprovider.resources_31bf3856ad364e35_4.0.15912.0_de-de_6e0b3ede914c826c\amd64_uiautomationprovider.resources_31bf3856ad364e35_4.0.15912.0_de-de_6e0b3ede914c826c.exe jaffacakes118_Worm.MSIL.Agent.ck.exe