Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 20:34
Static task
static1
Behavioral task
behavioral1
Sample
879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe
-
Size
126KB
-
MD5
879406741e41a8987cfe26a346b5618c
-
SHA1
aab1adb6ca9a2c511af69d01b18e96534c80310d
-
SHA256
5ee96d773aa3e0af784f65f7b6981d6153ec525f2ec896459597cce7be2d9dfa
-
SHA512
8945a1b6746ac04008ee8b0b119d2270cceef160fa79cf98c203c92c4920d93e81d8f0275be0eebdc99f3b5d575b5bafaaed61ea35743fb23ef6ecc9802d965f
-
SSDEEP
3072:ggoswCoBM8EBkVpWBYpo0ZTZWvWRsC9idfXP6jOD6g/l3D/AYI:msZoBzEBCW2powtWvpNSEH3bAYI
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1484 1976 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 91 PID 1976 wrote to memory of 1484 1976 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 91 PID 1976 wrote to memory of 1484 1976 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 91 PID 1484 wrote to memory of 2280 1484 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 92 PID 1484 wrote to memory of 2280 1484 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 92 PID 1484 wrote to memory of 2280 1484 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 92 PID 2280 wrote to memory of 3588 2280 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 93 PID 2280 wrote to memory of 3588 2280 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 93 PID 2280 wrote to memory of 3588 2280 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 93 PID 3588 wrote to memory of 3668 3588 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 94 PID 3588 wrote to memory of 3668 3588 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 94 PID 3588 wrote to memory of 3668 3588 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 94 PID 3668 wrote to memory of 1008 3668 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 95 PID 3668 wrote to memory of 1008 3668 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 95 PID 3668 wrote to memory of 1008 3668 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 95 PID 1008 wrote to memory of 1056 1008 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 96 PID 1008 wrote to memory of 1056 1008 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 96 PID 1008 wrote to memory of 1056 1008 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 96 PID 1056 wrote to memory of 2008 1056 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 97 PID 1056 wrote to memory of 2008 1056 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 97 PID 1056 wrote to memory of 2008 1056 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 97 PID 2008 wrote to memory of 2760 2008 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 98 PID 2008 wrote to memory of 2760 2008 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 98 PID 2008 wrote to memory of 2760 2008 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 98 PID 2760 wrote to memory of 2368 2760 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 99 PID 2760 wrote to memory of 2368 2760 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 99 PID 2760 wrote to memory of 2368 2760 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 99 PID 2368 wrote to memory of 1180 2368 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 100 PID 2368 wrote to memory of 1180 2368 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 100 PID 2368 wrote to memory of 1180 2368 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 100 PID 1180 wrote to memory of 1316 1180 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 101 PID 1180 wrote to memory of 1316 1180 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 101 PID 1180 wrote to memory of 1316 1180 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 101 PID 1316 wrote to memory of 4636 1316 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 102 PID 1316 wrote to memory of 4636 1316 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 102 PID 1316 wrote to memory of 4636 1316 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 102 PID 4636 wrote to memory of 988 4636 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 103 PID 4636 wrote to memory of 988 4636 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 103 PID 4636 wrote to memory of 988 4636 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 103 PID 988 wrote to memory of 2320 988 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 104 PID 988 wrote to memory of 2320 988 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 104 PID 988 wrote to memory of 2320 988 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 104 PID 2320 wrote to memory of 1888 2320 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 105 PID 2320 wrote to memory of 1888 2320 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 105 PID 2320 wrote to memory of 1888 2320 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 105 PID 1888 wrote to memory of 4788 1888 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 106 PID 1888 wrote to memory of 4788 1888 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 106 PID 1888 wrote to memory of 4788 1888 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 106 PID 4788 wrote to memory of 4484 4788 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 107 PID 4788 wrote to memory of 4484 4788 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 107 PID 4788 wrote to memory of 4484 4788 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 107 PID 4484 wrote to memory of 4468 4484 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 108 PID 4484 wrote to memory of 4468 4484 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 108 PID 4484 wrote to memory of 4468 4484 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 108 PID 4468 wrote to memory of 4280 4468 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 109 PID 4468 wrote to memory of 4280 4468 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 109 PID 4468 wrote to memory of 4280 4468 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 109 PID 4280 wrote to memory of 3988 4280 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 110 PID 4280 wrote to memory of 3988 4280 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 110 PID 4280 wrote to memory of 3988 4280 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 110 PID 3988 wrote to memory of 1852 3988 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 111 PID 3988 wrote to memory of 1852 3988 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 111 PID 3988 wrote to memory of 1852 3988 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 111 PID 1852 wrote to memory of 3980 1852 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe5⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe6⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe7⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe8⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe9⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe10⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe11⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe12⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe13⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe14⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe15⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe16⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe17⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe18⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe19⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe20⤵
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe21⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe22⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe23⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe24⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe25⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe26⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe27⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe28⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe29⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe30⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe31⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe32⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe33⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe34⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe35⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe36⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe37⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe38⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe39⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe40⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe41⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe42⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe43⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe44⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe45⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe46⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe47⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe48⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe49⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe50⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe51⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe52⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe53⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe54⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe55⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe56⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe57⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe58⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe59⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe60⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe61⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe62⤵
- System Location Discovery: System Language Discovery
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe63⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe64⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe65⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe66⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe67⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe68⤵
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe69⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe70⤵
- System Location Discovery: System Language Discovery
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe71⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe72⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe73⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe74⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe75⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe76⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe77⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe78⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe79⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe80⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe81⤵
- System Location Discovery: System Language Discovery
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe82⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe83⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe84⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe85⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe86⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe87⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe88⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe89⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe90⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe91⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe92⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe93⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe94⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe95⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe96⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe97⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe98⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe99⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe100⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe101⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe102⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe103⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe104⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe105⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe106⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe107⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe108⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe109⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe110⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe111⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe112⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe113⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe114⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe115⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe116⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe117⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe118⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe119⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe120⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe121⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe122⤵PID:5960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-