Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 19:57
Behavioral task
behavioral1
Sample
757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118.exe
-
Size
8KB
-
MD5
757f37fe648b4564c343f1e0fce8f27f
-
SHA1
fcf96c78b8476aca7c179eecaa055fd6bdb2c645
-
SHA256
24e64a43a16b0f3d4cba473f4a8a1ecad4ab42892bd314aa985117d21c30a47a
-
SHA512
e799157c05f1c00ec3bef0cae5cbd3c8e6cdfab0e00abb2573538e528e4dcfa000695a06076faf2f4aacb9823b7e89cbf308fa54f9d5f8833b8fae1127f446bd
-
SSDEEP
96:QKOHiF5yFYw55OUABrbuFgkaR0FxMpoESy41ZukzW39pembpvFEJtDInY:ZOH+4nFaCwpoEPkzW36mFvFEcY
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4568 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181.exe 4592 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181.exe 1652 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811.exe 564 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811.exe 888 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111.exe 3408 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111.exe 1252 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111.exe 2872 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111.exe 4984 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111.exe 4496 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111.exe 3844 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111.exe 4968 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111.exe 3800 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111.exe 3624 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111.exe 4224 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111.exe 3488 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111.exe 4868 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111.exe 444 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111.exe 436 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111.exe 1072 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111.exe 3668 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111.exe 4796 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111.exe 316 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111.exe 1208 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111.exe 3628 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111.exe 4256 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111.exe 1396 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111.exe 4956 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111.exe 2296 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111.exe 3832 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111.exe 2148 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111.exe 3508 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111.exe 4684 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111.exe 1568 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111.exe 3336 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111.exe 4144 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111.exe 4944 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111.exe 1108 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111.exe 4492 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111.exe 4024 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111.exe 4364 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111.exe 1500 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111.exe 3980 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111.exe 3984 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111.exe 4624 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111.exe 1876 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111.exe 2732 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111.exe 3092 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111.exe 1216 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111.exe 956 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111.exe 4488 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111.exe 2028 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111.exe 1540 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111.exe 4136 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111.exe 4248 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111.exe 880 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111.exe 1660 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111.exe 1676 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111.exe 4264 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111.exe 900 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111.exe 3344 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111.exe 2000 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111.exe 400 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111.exe 4808 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111.exe -
resource yara_rule behavioral2/memory/4580-0-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/files/0x000900000002347e-9.dat upx behavioral2/memory/4568-12-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4592-20-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4580-62-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/2612-70-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4568-75-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4592-84-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1652-89-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/564-98-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/888-104-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3408-112-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1252-117-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/2872-126-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4984-132-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4496-140-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3844-145-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4968-154-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3800-160-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3624-168-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4224-174-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3488-183-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4868-188-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/444-196-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/436-203-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1072-210-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3832-211-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3668-223-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/2148-224-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4796-226-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/316-232-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1208-240-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3628-246-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4256-254-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1396-260-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4956-268-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/2296-274-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3832-282-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3508-295-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4684-300-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1568-307-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3336-311-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4144-318-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4944-322-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1108-329-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4492-333-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4024-340-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4364-345-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1500-352-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3980-355-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3984-362-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4624-366-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1876-373-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/2732-377-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3092-384-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1216-388-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/956-395-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4488-399-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/2028-407-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1540-410-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4136-417-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4248-422-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/880-428-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1660-432-0x0000000000400000-0x0000000000409000-memory.dmp upx -
Program crash 2 IoCs
pid pid_target Process procid_target 32112 28456 Process not Found 31852 31860 Process not Found 2294 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID Process not Found -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeCreateGlobalPrivilege 32164 Process not Found Token: SeChangeNotifyPrivilege 32164 Process not Found Token: 33 32164 Process not Found Token: SeIncBasePriorityPrivilege 32164 Process not Found -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4580 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118.exe 2612 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118.exe 4568 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181.exe 4592 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181.exe 1652 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811.exe 564 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811.exe 888 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111.exe 3408 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111.exe 1252 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111.exe 2872 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111.exe 4984 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111.exe 4496 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111.exe 3844 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111.exe 4968 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111.exe 3800 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111.exe 3624 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111.exe 4224 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111.exe 3488 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111.exe 4868 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111.exe 444 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111.exe 436 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111.exe 1072 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111.exe 3668 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111.exe 4796 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111.exe 316 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111.exe 1208 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111.exe 3628 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111.exe 4256 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111.exe 1396 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111.exe 4956 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111.exe 2296 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111.exe 3832 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111.exe 2148 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111.exe 3508 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111.exe 4684 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111.exe 1568 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111.exe 3336 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111.exe 4144 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111.exe 4944 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111.exe 1108 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111.exe 4492 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111.exe 4024 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111.exe 4364 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111.exe 1500 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111.exe 3980 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111.exe 3984 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111.exe 4624 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111.exe 1876 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111.exe 2732 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111.exe 3092 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111.exe 1216 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111.exe 956 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111.exe 4488 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111.exe 2028 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111.exe 1540 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111.exe 4136 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111.exe 4248 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111.exe 880 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111.exe 1660 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111.exe 1676 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111.exe 4264 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111.exe 900 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111.exe 3344 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111.exe 2000 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 2612 4580 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118.exe 84 PID 4580 wrote to memory of 2612 4580 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118.exe 84 PID 4580 wrote to memory of 2612 4580 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118.exe 84 PID 2612 wrote to memory of 4568 2612 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118.exe 85 PID 2612 wrote to memory of 4568 2612 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118.exe 85 PID 2612 wrote to memory of 4568 2612 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118.exe 85 PID 4568 wrote to memory of 4592 4568 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181.exe 86 PID 4568 wrote to memory of 4592 4568 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181.exe 86 PID 4568 wrote to memory of 4592 4568 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181.exe 86 PID 4592 wrote to memory of 1652 4592 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181.exe 87 PID 4592 wrote to memory of 1652 4592 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181.exe 87 PID 4592 wrote to memory of 1652 4592 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181.exe 87 PID 1652 wrote to memory of 564 1652 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811.exe 88 PID 1652 wrote to memory of 564 1652 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811.exe 88 PID 1652 wrote to memory of 564 1652 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811.exe 88 PID 564 wrote to memory of 888 564 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811.exe 89 PID 564 wrote to memory of 888 564 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811.exe 89 PID 564 wrote to memory of 888 564 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811.exe 89 PID 888 wrote to memory of 3408 888 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111.exe 90 PID 888 wrote to memory of 3408 888 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111.exe 90 PID 888 wrote to memory of 3408 888 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111.exe 90 PID 3408 wrote to memory of 1252 3408 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111.exe 91 PID 3408 wrote to memory of 1252 3408 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111.exe 91 PID 3408 wrote to memory of 1252 3408 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111.exe 91 PID 1252 wrote to memory of 2872 1252 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111.exe 92 PID 1252 wrote to memory of 2872 1252 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111.exe 92 PID 1252 wrote to memory of 2872 1252 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111.exe 92 PID 2872 wrote to memory of 4984 2872 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111.exe 93 PID 2872 wrote to memory of 4984 2872 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111.exe 93 PID 2872 wrote to memory of 4984 2872 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111.exe 93 PID 4984 wrote to memory of 4496 4984 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111.exe 94 PID 4984 wrote to memory of 4496 4984 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111.exe 94 PID 4984 wrote to memory of 4496 4984 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111.exe 94 PID 4496 wrote to memory of 3844 4496 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111.exe 95 PID 4496 wrote to memory of 3844 4496 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111.exe 95 PID 4496 wrote to memory of 3844 4496 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111.exe 95 PID 3844 wrote to memory of 4968 3844 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111.exe 97 PID 3844 wrote to memory of 4968 3844 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111.exe 97 PID 3844 wrote to memory of 4968 3844 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111.exe 97 PID 4968 wrote to memory of 3800 4968 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111.exe 98 PID 4968 wrote to memory of 3800 4968 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111.exe 98 PID 4968 wrote to memory of 3800 4968 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111.exe 98 PID 3800 wrote to memory of 3624 3800 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111.exe 99 PID 3800 wrote to memory of 3624 3800 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111.exe 99 PID 3800 wrote to memory of 3624 3800 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111.exe 99 PID 3624 wrote to memory of 4224 3624 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111.exe 101 PID 3624 wrote to memory of 4224 3624 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111.exe 101 PID 3624 wrote to memory of 4224 3624 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111.exe 101 PID 4224 wrote to memory of 3488 4224 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111.exe 102 PID 4224 wrote to memory of 3488 4224 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111.exe 102 PID 4224 wrote to memory of 3488 4224 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111.exe 102 PID 3488 wrote to memory of 4868 3488 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111.exe 103 PID 3488 wrote to memory of 4868 3488 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111.exe 103 PID 3488 wrote to memory of 4868 3488 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111.exe 103 PID 4868 wrote to memory of 444 4868 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111.exe 104 PID 4868 wrote to memory of 444 4868 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111.exe 104 PID 4868 wrote to memory of 444 4868 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111.exe 104 PID 444 wrote to memory of 436 444 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111.exe 106 PID 444 wrote to memory of 436 444 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111.exe 106 PID 444 wrote to memory of 436 444 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111.exe 106 PID 436 wrote to memory of 1072 436 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111.exe 107 PID 436 wrote to memory of 1072 436 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111.exe 107 PID 436 wrote to memory of 1072 436 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111.exe 107 PID 1072 wrote to memory of 3668 1072 757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118.exe2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111.exe10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111.exe11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111.exe12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111.exe13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111.exe14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111.exe15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111.exe16⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111.exe17⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111.exe18⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111.exe19⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111.exe20⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111.exe21⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111.exe22⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111.exe23⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111.exe24⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111.exe25⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:316 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111.exe26⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111.exe27⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111.exe28⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111.exe29⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111.exe30⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111.exe31⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111.exe32⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111.exe33⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111.exe34⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111.exe35⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111.exe36⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111.exe37⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111.exe38⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111.exe39⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111.exe40⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111.exe41⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111.exe42⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111.exe43⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111.exe44⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111.exe45⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111.exe46⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111.exe47⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111.exe48⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111.exe49⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111.exe50⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111.exe51⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111.exe52⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:956 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111.exe53⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111.exe54⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111.exe55⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111.exe56⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111.exe57⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111.exe58⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:880 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111.exe59⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111.exe60⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111.exe61⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111.exe62⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:900 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111.exe63⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111.exe64⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111.exe65⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111.exe66⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111.exe67⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111.exe68⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111.exe69⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111.exe70⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111.exe71⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111.exe72⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111.exe73⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111.exe74⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111.exe75⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111.exe76⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111.exe77⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111.exe78⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111.exe79⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111.exe80⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111.exe81⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111.exe82⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111.exe83⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111.exe84⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111.exe85⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111.exe86⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111.exe87⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111.exe88⤵
- System Location Discovery: System Language Discovery
PID:892 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111.exe89⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111.exe90⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111.exe91⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111.exe92⤵
- System Location Discovery: System Language Discovery
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111.exe93⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111.exe94⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111.exe95⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111.exe96⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111.exe97⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111.exe98⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111.exe99⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111.exe100⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111.exe101⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111.exe102⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111.exe103⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111.exe104⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111.exe105⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111.exe106⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111111.exe107⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111111.exe108⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111.exe109⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111.exe110⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111111.exe111⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111111.exe112⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111111111.exe113⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111111111.exe114⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111111.exe115⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111111.exe116⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111111111.exe117⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes1181111111111111111111111111111111111111111111111111111111111.exe118⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111111111111.exe119⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes11811111111111111111111111111111111111111111111111111111111111.exe120⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111111111.exe121⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111111111.exeC:\Users\Admin\AppData\Local\Temp\757f37fe648b4564c343f1e0fce8f27f_JaffaCakes118111111111111111111111111111111111111111111111111111111111111.exe122⤵
- System Location Discovery: System Language Discovery
PID:5672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-