Analysis
-
max time kernel
141s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 06:19
Static task
static1
Behavioral task
behavioral1
Sample
a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe
-
Size
953KB
-
MD5
a5b48cf03fe50912726905947a7be884
-
SHA1
d1eff0d9c492aa837e12cc0ee1bb32d357e1cade
-
SHA256
896d4d2b07c607a86bf139d10a29043a4bca31653bc3de9519711b704cf25bb5
-
SHA512
5b18dcac2fc48233362a733dd07ba9a58300a0652d3b50f5b5f5ed5bf03313fa5d487cc465b4e25bacb4609ae9e579ae688e8af4d24ac13dffe2b1aa7bde0024
-
SSDEEP
12288:sJ9TqmNr0iFV3AcP3ZfdTR9txSwRqsY6ISBwcsEd5+Pb3JTITTDdhamk+uTbX:sXqnmNUX
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5004 wrote to memory of 2336 5004 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 91 PID 5004 wrote to memory of 2336 5004 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 91 PID 5004 wrote to memory of 2336 5004 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 91 PID 2336 wrote to memory of 3140 2336 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 92 PID 2336 wrote to memory of 3140 2336 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 92 PID 2336 wrote to memory of 3140 2336 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 92 PID 3140 wrote to memory of 4708 3140 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 93 PID 3140 wrote to memory of 4708 3140 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 93 PID 3140 wrote to memory of 4708 3140 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 93 PID 4708 wrote to memory of 3712 4708 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 94 PID 4708 wrote to memory of 3712 4708 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 94 PID 4708 wrote to memory of 3712 4708 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 94 PID 3712 wrote to memory of 4204 3712 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 95 PID 3712 wrote to memory of 4204 3712 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 95 PID 3712 wrote to memory of 4204 3712 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 95 PID 4204 wrote to memory of 4672 4204 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 96 PID 4204 wrote to memory of 4672 4204 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 96 PID 4204 wrote to memory of 4672 4204 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 96 PID 4672 wrote to memory of 644 4672 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 97 PID 4672 wrote to memory of 644 4672 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 97 PID 4672 wrote to memory of 644 4672 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 97 PID 644 wrote to memory of 4792 644 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 98 PID 644 wrote to memory of 4792 644 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 98 PID 644 wrote to memory of 4792 644 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 98 PID 4792 wrote to memory of 2388 4792 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 99 PID 4792 wrote to memory of 2388 4792 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 99 PID 4792 wrote to memory of 2388 4792 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 99 PID 2388 wrote to memory of 3548 2388 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 100 PID 2388 wrote to memory of 3548 2388 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 100 PID 2388 wrote to memory of 3548 2388 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 100 PID 3548 wrote to memory of 5076 3548 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 101 PID 3548 wrote to memory of 5076 3548 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 101 PID 3548 wrote to memory of 5076 3548 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 101 PID 5076 wrote to memory of 4424 5076 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 102 PID 5076 wrote to memory of 4424 5076 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 102 PID 5076 wrote to memory of 4424 5076 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 102 PID 4424 wrote to memory of 3868 4424 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 103 PID 4424 wrote to memory of 3868 4424 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 103 PID 4424 wrote to memory of 3868 4424 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 103 PID 3868 wrote to memory of 2568 3868 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 104 PID 3868 wrote to memory of 2568 3868 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 104 PID 3868 wrote to memory of 2568 3868 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 104 PID 2568 wrote to memory of 1608 2568 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 105 PID 2568 wrote to memory of 1608 2568 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 105 PID 2568 wrote to memory of 1608 2568 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 105 PID 1608 wrote to memory of 3032 1608 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 106 PID 1608 wrote to memory of 3032 1608 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 106 PID 1608 wrote to memory of 3032 1608 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 106 PID 3032 wrote to memory of 4348 3032 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 107 PID 3032 wrote to memory of 4348 3032 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 107 PID 3032 wrote to memory of 4348 3032 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 107 PID 4348 wrote to memory of 3412 4348 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 108 PID 4348 wrote to memory of 3412 4348 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 108 PID 4348 wrote to memory of 3412 4348 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 108 PID 3412 wrote to memory of 3848 3412 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 109 PID 3412 wrote to memory of 3848 3412 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 109 PID 3412 wrote to memory of 3848 3412 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 109 PID 3848 wrote to memory of 3904 3848 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 110 PID 3848 wrote to memory of 3904 3848 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 110 PID 3848 wrote to memory of 3904 3848 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 110 PID 3904 wrote to memory of 1580 3904 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 111 PID 3904 wrote to memory of 1580 3904 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 111 PID 3904 wrote to memory of 1580 3904 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 111 PID 1580 wrote to memory of 3900 1580 a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"9⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"11⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"12⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"13⤵
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"14⤵
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"16⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"17⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"19⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"20⤵
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"21⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"22⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"23⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"24⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"25⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"26⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"27⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"28⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"29⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"30⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"31⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"32⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"33⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"34⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"35⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"36⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"37⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"38⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"39⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"40⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"41⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"42⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"43⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"44⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"45⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"46⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"47⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"48⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"49⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"50⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"51⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"52⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"53⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"54⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"55⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"56⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"57⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"58⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"59⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"60⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"61⤵
- System Location Discovery: System Language Discovery
PID:956 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"62⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"63⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"64⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"65⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"66⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"67⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"68⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"69⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"70⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"71⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"72⤵
- System Location Discovery: System Language Discovery
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"73⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"74⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"75⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"76⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"77⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"78⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"79⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"80⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"81⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"82⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"83⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"84⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"85⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"86⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"87⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"88⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"89⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"90⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"91⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"92⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"93⤵
- System Location Discovery: System Language Discovery
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"94⤵PID:5508
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"95⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"96⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"97⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"98⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"99⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"100⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"101⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"102⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"103⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"104⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"105⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"106⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"107⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"108⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"109⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"110⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"111⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"112⤵
- System Location Discovery: System Language Discovery
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"113⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"114⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"115⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"116⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"117⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"118⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"119⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"120⤵
- System Location Discovery: System Language Discovery
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"121⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b48cf03fe50912726905947a7be884_JaffaCakes118.exe"122⤵PID:5996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-