Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
6s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2024, 19:55
Static task
static1
Behavioral task
behavioral1
Sample
b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe
-
Size
6KB
-
MD5
b09c7777e40e9284fe76d7f0a58872e4
-
SHA1
92b6523a623833a1e712c0de0759c0e4d3093549
-
SHA256
150ea33be12dfbd6b608bd16b35c68914940adf8792b1edd31903e287923adf5
-
SHA512
6492d9ec32aa1e5ec7440573a5937ef767e9c0577e5b6e152ebdd522bbe04e284d9907f3e83d0c15c45d79c8664e5dbe7ffd550a50b1e80e555d10f5a2e4588c
-
SSDEEP
96:Qs+nFQtTXC4gFetn/0Qr3J2ZtQX7jQhV8:Qs+FB4gctvgmrE
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 61 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 61 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3396 wrote to memory of 2488 3396 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 84 PID 3396 wrote to memory of 2488 3396 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 84 PID 3396 wrote to memory of 2488 3396 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 84 PID 2488 wrote to memory of 3872 2488 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 85 PID 2488 wrote to memory of 3872 2488 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 85 PID 2488 wrote to memory of 3872 2488 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 85 PID 3872 wrote to memory of 1956 3872 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 87 PID 3872 wrote to memory of 1956 3872 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 87 PID 3872 wrote to memory of 1956 3872 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 87 PID 1956 wrote to memory of 516 1956 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 88 PID 1956 wrote to memory of 516 1956 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 88 PID 1956 wrote to memory of 516 1956 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 88 PID 516 wrote to memory of 2200 516 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 89 PID 516 wrote to memory of 2200 516 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 89 PID 516 wrote to memory of 2200 516 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 89 PID 2200 wrote to memory of 3920 2200 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 90 PID 2200 wrote to memory of 3920 2200 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 90 PID 2200 wrote to memory of 3920 2200 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 90 PID 3920 wrote to memory of 4820 3920 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 91 PID 3920 wrote to memory of 4820 3920 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 91 PID 3920 wrote to memory of 4820 3920 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 91 PID 4820 wrote to memory of 1592 4820 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 93 PID 4820 wrote to memory of 1592 4820 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 93 PID 4820 wrote to memory of 1592 4820 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 93 PID 1592 wrote to memory of 1808 1592 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 94 PID 1592 wrote to memory of 1808 1592 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 94 PID 1592 wrote to memory of 1808 1592 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 94 PID 1808 wrote to memory of 3804 1808 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 95 PID 1808 wrote to memory of 3804 1808 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 95 PID 1808 wrote to memory of 3804 1808 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 95 PID 3804 wrote to memory of 4928 3804 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 96 PID 3804 wrote to memory of 4928 3804 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 96 PID 3804 wrote to memory of 4928 3804 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 96 PID 4928 wrote to memory of 436 4928 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 97 PID 4928 wrote to memory of 436 4928 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 97 PID 4928 wrote to memory of 436 4928 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 97 PID 436 wrote to memory of 3080 436 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 98 PID 436 wrote to memory of 3080 436 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 98 PID 436 wrote to memory of 3080 436 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 98 PID 3080 wrote to memory of 760 3080 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 99 PID 3080 wrote to memory of 760 3080 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 99 PID 3080 wrote to memory of 760 3080 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 99 PID 760 wrote to memory of 4200 760 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 100 PID 760 wrote to memory of 4200 760 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 100 PID 760 wrote to memory of 4200 760 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 100 PID 4200 wrote to memory of 3440 4200 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 101 PID 4200 wrote to memory of 3440 4200 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 101 PID 4200 wrote to memory of 3440 4200 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 101 PID 3440 wrote to memory of 3680 3440 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 102 PID 3440 wrote to memory of 3680 3440 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 102 PID 3440 wrote to memory of 3680 3440 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 102 PID 3680 wrote to memory of 3004 3680 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 103 PID 3680 wrote to memory of 3004 3680 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 103 PID 3680 wrote to memory of 3004 3680 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 103 PID 3004 wrote to memory of 224 3004 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 104 PID 3004 wrote to memory of 224 3004 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 104 PID 3004 wrote to memory of 224 3004 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 104 PID 224 wrote to memory of 2544 224 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 105 PID 224 wrote to memory of 2544 224 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 105 PID 224 wrote to memory of 2544 224 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 105 PID 2544 wrote to memory of 1980 2544 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 107 PID 2544 wrote to memory of 1980 2544 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 107 PID 2544 wrote to memory of 1980 2544 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 107 PID 1980 wrote to memory of 3416 1980 b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"6⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"7⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"8⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"9⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"10⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"11⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"12⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"13⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"14⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"15⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"16⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"17⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"18⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"19⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"20⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"21⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"22⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"23⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"24⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"25⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"26⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"27⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"28⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"29⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"30⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"31⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"32⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"33⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:212 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"34⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"35⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"36⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"37⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"38⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"39⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"40⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"41⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"42⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"43⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"44⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"45⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"46⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"47⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"48⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"49⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"50⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"51⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"52⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"53⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"54⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"55⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"56⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"57⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"58⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"59⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"60⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"61⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:6148 -
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"62⤵PID:6240
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"63⤵PID:6332
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"64⤵PID:6444
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"65⤵PID:6532
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"66⤵PID:6608
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"67⤵PID:6700
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"68⤵PID:6788
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"69⤵PID:6860
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"70⤵PID:6936
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"71⤵PID:7008
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"72⤵PID:7092
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"73⤵PID:6164
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"74⤵PID:6364
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"75⤵PID:6556
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"76⤵PID:6744
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"77⤵PID:6944
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"78⤵PID:7104
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"79⤵PID:6456
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"80⤵PID:6824
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"81⤵PID:6188
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"82⤵PID:6464
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"83⤵PID:7204
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"84⤵PID:7280
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"85⤵PID:7352
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"86⤵PID:7424
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"87⤵PID:7496
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"88⤵PID:7608
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"89⤵PID:7684
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"90⤵PID:7760
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"91⤵PID:7836
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"92⤵PID:7908
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"93⤵PID:7980
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"94⤵PID:8052
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"95⤵PID:8124
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"96⤵PID:6972
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"97⤵PID:7300
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"98⤵PID:7468
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"99⤵PID:7652
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"100⤵PID:7856
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"101⤵PID:8000
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"102⤵PID:8156
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"103⤵PID:7440
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"104⤵PID:7868
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"105⤵PID:7220
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"106⤵PID:7936
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"107⤵PID:7528
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"108⤵PID:8260
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"109⤵PID:8332
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"110⤵PID:8408
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"111⤵PID:8480
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"112⤵PID:8552
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"113⤵PID:8644
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"114⤵PID:8764
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"115⤵PID:8880
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"116⤵PID:8968
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"117⤵PID:9040
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"118⤵PID:9112
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"119⤵PID:9184
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"120⤵PID:8288
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"121⤵PID:8436
-
C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09c7777e40e9284fe76d7f0a58872e4_JaffaCakes118.exe"122⤵PID:8656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-