Analysis
- max time kernel
67s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240730-en - resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system - submitted
02/08/2024, 04:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe
Resource
win7-20240708-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe
Resource
win10v2004-20240730-en
4 signatures
150 seconds
General
- Target 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe
- Size 2.7MB
- Sample240802-ewe5wavhql
- SHA256 bc18737d78e43a40e0088c038b0f2f5b731359941be4619fbd837a6366724763
- MD5 82fffd4da6f3e6fd206596c03b8dc005
- SHA1 6358c3a5bd494775a70ca13fb79a79a4a611a22b
- SHA512 39721da2485028d601e10b65f2eebb64a9fc7dbafaf5975ba3419135e2ce8d80ab874dc55dfbd0c2c0e1dc8abda85dac85b4b57d2c2d8b37433862f1ffa7dfbd
- SSDEEP 49152:aRmRhaCEc5hkOFnmvNJ7/P4tOx9ReasY6DwOBfrnvV7UeWtY5:aRmRhk+ruJD4tOx9AYiwOBpIeWa5
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5028 wrote to memory of 3928 5028 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 86 PID 5028 wrote to memory of 3928 5028 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 86 PID 5028 wrote to memory of 3928 5028 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 86 PID 3928 wrote to memory of 1184 3928 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 87 PID 3928 wrote to memory of 1184 3928 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 87 PID 3928 wrote to memory of 1184 3928 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 87 PID 1184 wrote to memory of 4948 1184 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 88 PID 1184 wrote to memory of 4948 1184 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 88 PID 1184 wrote to memory of 4948 1184 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 88 PID 4948 wrote to memory of 1660 4948 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 89 PID 4948 wrote to memory of 1660 4948 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 89 PID 4948 wrote to memory of 1660 4948 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 89 PID 1660 wrote to memory of 1116 1660 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 90 PID 1660 wrote to memory of 1116 1660 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 90 PID 1660 wrote to memory of 1116 1660 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 90 PID 1116 wrote to memory of 2376 1116 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 91 PID 1116 wrote to memory of 2376 1116 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 91 PID 1116 wrote to memory of 2376 1116 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 91 PID 2376 wrote to memory of 4568 2376 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 92 PID 2376 wrote to memory of 4568 2376 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 92 PID 2376 wrote to memory of 4568 2376 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 92 PID 4568 wrote to memory of 4524 4568 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 93 PID 4568 wrote to memory of 4524 4568 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 93 PID 4568 wrote to memory of 4524 4568 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 93 PID 4524 wrote to memory of 3452 4524 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 94 PID 4524 wrote to memory of 3452 4524 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 94 PID 4524 wrote to memory of 3452 4524 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 94 PID 3452 wrote to memory of 2440 3452 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 95 PID 3452 wrote to memory of 2440 3452 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 95 PID 3452 wrote to memory of 2440 3452 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 95 PID 2440 wrote to memory of 2356 2440 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 96 PID 2440 wrote to memory of 2356 2440 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 96 PID 2440 wrote to memory of 2356 2440 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 96 PID 2356 wrote to memory of 4192 2356 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 97 PID 2356 wrote to memory of 4192 2356 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 97 PID 2356 wrote to memory of 4192 2356 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 97 PID 4192 wrote to memory of 1000 4192 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 98 PID 4192 wrote to memory of 1000 4192 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 98 PID 4192 wrote to memory of 1000 4192 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 98 PID 1000 wrote to memory of 3412 1000 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 99 PID 1000 wrote to memory of 3412 1000 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 99 PID 1000 wrote to memory of 3412 1000 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 99 PID 3412 wrote to memory of 3872 3412 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 100 PID 3412 wrote to memory of 3872 3412 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 100 PID 3412 wrote to memory of 3872 3412 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 100 PID 3872 wrote to memory of 1888 3872 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 101 PID 3872 wrote to memory of 1888 3872 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 101 PID 3872 wrote to memory of 1888 3872 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 101 PID 1888 wrote to memory of 4700 1888 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 102 PID 1888 wrote to memory of 4700 1888 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 102 PID 1888 wrote to memory of 4700 1888 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 102 PID 4700 wrote to memory of 1880 4700 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 103 PID 4700 wrote to memory of 1880 4700 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 103 PID 4700 wrote to memory of 1880 4700 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 103 PID 1880 wrote to memory of 2128 1880 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 104 PID 1880 wrote to memory of 2128 1880 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 104 PID 1880 wrote to memory of 2128 1880 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 104 PID 2128 wrote to memory of 2784 2128 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 105 PID 2128 wrote to memory of 2784 2128 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 105 PID 2128 wrote to memory of 2784 2128 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 105 PID 2784 wrote to memory of 2336 2784 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 106 PID 2784 wrote to memory of 2336 2784 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 106 PID 2784 wrote to memory of 2336 2784 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 106 PID 2336 wrote to memory of 3416 2336 82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"9⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"10⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"11⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"12⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"14⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"16⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"17⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"19⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"20⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"21⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"23⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"24⤵
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"25⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"26⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"27⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"28⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"29⤵
- Checks computer location settings
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"30⤵
- Checks computer location settings
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"31⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"32⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"33⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"34⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"35⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"36⤵
- Checks computer location settings
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"37⤵
- System Location Discovery: System Language Discovery
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"38⤵
- Checks computer location settings
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"39⤵
- System Location Discovery: System Language Discovery
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"40⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"41⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"42⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"43⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"44⤵
- System Location Discovery: System Language Discovery
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"45⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"46⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"47⤵
- Checks computer location settings
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"48⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"49⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"50⤵
- System Location Discovery: System Language Discovery
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"51⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"52⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"53⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"54⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"55⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"56⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"57⤵
- Checks computer location settings
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"58⤵
- System Location Discovery: System Language Discovery
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"59⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"60⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"61⤵
- System Location Discovery: System Language Discovery
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"62⤵
- System Location Discovery: System Language Discovery
PID:684 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"63⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"64⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"65⤵
- System Location Discovery: System Language Discovery
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"66⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"67⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"68⤵
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"69⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"70⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"71⤵
- System Location Discovery: System Language Discovery
PID:548 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"72⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"73⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"74⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"75⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"76⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"77⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"78⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"79⤵
- System Location Discovery: System Language Discovery
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"80⤵
- Checks computer location settings
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"81⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"82⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"83⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"84⤵
- Checks computer location settings
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"85⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"86⤵
- System Location Discovery: System Language Discovery
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"87⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"88⤵
- Checks computer location settings
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"89⤵
- System Location Discovery: System Language Discovery
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"90⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"91⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"92⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"93⤵
- Checks computer location settings
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"94⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"95⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"96⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"97⤵
- Checks computer location settings
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"98⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"99⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"100⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"101⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"102⤵
- Checks computer location settings
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"103⤵
- Checks computer location settings
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"104⤵
- System Location Discovery: System Language Discovery
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"105⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"106⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"107⤵
- System Location Discovery: System Language Discovery
PID:940 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"108⤵
- Checks computer location settings
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"109⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"110⤵
- Checks computer location settings
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"111⤵
- System Location Discovery: System Language Discovery
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"112⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"113⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"114⤵
- Checks computer location settings
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"115⤵
- Checks computer location settings
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"116⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"117⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"118⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"119⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"120⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"121⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fffd4da6f3e6fd206596c03b8dc005_JaffaCakes118.exe"122⤵PID:4888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-