Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 11:59
Static task
static1
Behavioral task
behavioral1
Sample
8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
8ea9032179f548de8b5b0e9ffe37c579
-
SHA1
5ee46f1a525be2fb15675455e8cf445275e704f4
-
SHA256
8bff895657348a1a25a8f0809e6c1e747ff0dbce03b8e204deac9f777e3dd95a
-
SHA512
6810873bee45bce423a58f1b37ef23cb587cfa1258c83de3ea89aafcaa6374dd8905fb2bc521686a18a90283df69ad4db5c2dbe96e8f8b3763a0dddbe4449dae
-
SSDEEP
24576:NvPIDp0++k467h1xFvbeD9YVFXFzv1BsHnm1IR:NvPIDtIiUYeHm1
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1716 wrote to memory of 4460 1716 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 86 PID 1716 wrote to memory of 4460 1716 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 86 PID 1716 wrote to memory of 4460 1716 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 86 PID 4460 wrote to memory of 4968 4460 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 89 PID 4460 wrote to memory of 4968 4460 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 89 PID 4460 wrote to memory of 4968 4460 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 89 PID 4968 wrote to memory of 2468 4968 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 90 PID 4968 wrote to memory of 2468 4968 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 90 PID 4968 wrote to memory of 2468 4968 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 90 PID 2468 wrote to memory of 32 2468 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 91 PID 2468 wrote to memory of 32 2468 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 91 PID 2468 wrote to memory of 32 2468 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 91 PID 32 wrote to memory of 1700 32 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 92 PID 32 wrote to memory of 1700 32 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 92 PID 32 wrote to memory of 1700 32 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 92 PID 1700 wrote to memory of 4552 1700 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 93 PID 1700 wrote to memory of 4552 1700 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 93 PID 1700 wrote to memory of 4552 1700 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 93 PID 4552 wrote to memory of 644 4552 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 94 PID 4552 wrote to memory of 644 4552 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 94 PID 4552 wrote to memory of 644 4552 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 94 PID 644 wrote to memory of 4524 644 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 95 PID 644 wrote to memory of 4524 644 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 95 PID 644 wrote to memory of 4524 644 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 95 PID 4524 wrote to memory of 1760 4524 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 96 PID 4524 wrote to memory of 1760 4524 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 96 PID 4524 wrote to memory of 1760 4524 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 96 PID 1760 wrote to memory of 4828 1760 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 97 PID 1760 wrote to memory of 4828 1760 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 97 PID 1760 wrote to memory of 4828 1760 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 97 PID 4828 wrote to memory of 2068 4828 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 98 PID 4828 wrote to memory of 2068 4828 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 98 PID 4828 wrote to memory of 2068 4828 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 98 PID 2068 wrote to memory of 2808 2068 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 99 PID 2068 wrote to memory of 2808 2068 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 99 PID 2068 wrote to memory of 2808 2068 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 99 PID 2808 wrote to memory of 1764 2808 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 100 PID 2808 wrote to memory of 1764 2808 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 100 PID 2808 wrote to memory of 1764 2808 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 100 PID 1764 wrote to memory of 1708 1764 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 101 PID 1764 wrote to memory of 1708 1764 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 101 PID 1764 wrote to memory of 1708 1764 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 101 PID 1708 wrote to memory of 4660 1708 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 123 PID 1708 wrote to memory of 4660 1708 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 123 PID 1708 wrote to memory of 4660 1708 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 123 PID 4660 wrote to memory of 2492 4660 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 103 PID 4660 wrote to memory of 2492 4660 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 103 PID 4660 wrote to memory of 2492 4660 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 103 PID 2492 wrote to memory of 1920 2492 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 104 PID 2492 wrote to memory of 1920 2492 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 104 PID 2492 wrote to memory of 1920 2492 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 104 PID 1920 wrote to memory of 684 1920 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 105 PID 1920 wrote to memory of 684 1920 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 105 PID 1920 wrote to memory of 684 1920 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 105 PID 684 wrote to memory of 4848 684 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 106 PID 684 wrote to memory of 4848 684 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 106 PID 684 wrote to memory of 4848 684 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 106 PID 4848 wrote to memory of 4284 4848 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 107 PID 4848 wrote to memory of 4284 4848 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 107 PID 4848 wrote to memory of 4284 4848 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 107 PID 4284 wrote to memory of 224 4284 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 108 PID 4284 wrote to memory of 224 4284 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 108 PID 4284 wrote to memory of 224 4284 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 108 PID 224 wrote to memory of 1272 224 8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"8⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"9⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"10⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"11⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"12⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"13⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"14⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"16⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"17⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"18⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"19⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"20⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"21⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"22⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"23⤵
- System Location Discovery: System Language Discovery
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"24⤵
- Checks computer location settings
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"25⤵
- Checks computer location settings
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"26⤵
- System Location Discovery: System Language Discovery
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"27⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"28⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"29⤵
- Checks computer location settings
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"30⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"31⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"32⤵
- System Location Discovery: System Language Discovery
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"33⤵
- Checks computer location settings
PID:660 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"34⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"35⤵
- Checks computer location settings
PID:748 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"36⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"37⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"38⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"39⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"40⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"41⤵
- System Location Discovery: System Language Discovery
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"42⤵
- Checks computer location settings
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"43⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"44⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"45⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"46⤵
- System Location Discovery: System Language Discovery
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"47⤵
- System Location Discovery: System Language Discovery
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"48⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"49⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"50⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"51⤵
- System Location Discovery: System Language Discovery
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"52⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"53⤵
- Checks computer location settings
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"54⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"55⤵
- Checks computer location settings
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"56⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"57⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"58⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"59⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"60⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"61⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"62⤵
- System Location Discovery: System Language Discovery
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"63⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"64⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"65⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"66⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"67⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"68⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"69⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"70⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"71⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"72⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"73⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"74⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"75⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"76⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"77⤵
- System Location Discovery: System Language Discovery
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"78⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"79⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"80⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"81⤵
- Checks computer location settings
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"82⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"83⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"84⤵
- Checks computer location settings
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"85⤵
- Checks computer location settings
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"86⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"87⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"88⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"89⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:396 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"90⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"91⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"92⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"93⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"94⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"95⤵
- System Location Discovery: System Language Discovery
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"96⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"97⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"98⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"99⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"100⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"101⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"102⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"103⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"104⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"105⤵
- Checks computer location settings
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"106⤵
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"107⤵
- Checks computer location settings
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"108⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"109⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"110⤵
- Checks computer location settings
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"111⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"112⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"113⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"114⤵
- Checks computer location settings
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"115⤵
- System Location Discovery: System Language Discovery
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"116⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"117⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"118⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"119⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"120⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"121⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea9032179f548de8b5b0e9ffe37c579_JaffaCakes118.exe"122⤵PID:5004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-