Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 13:14
Static task
static1
Behavioral task
behavioral1
Sample
b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe
-
Size
897KB
-
MD5
b39838fbc2ad08718f1a6a5a6348e9d6
-
SHA1
e1163c2b3c84f107ec2385a7414312ebf8b5ad0e
-
SHA256
8de9fbbb2473e6a0fccf2a604bdd7a9bc770f65890a4b01eda632ac1852029a1
-
SHA512
30ae79510022290e685c09f787d77ba42a840bf7014c2eb244193c2772ce7c5d823462455eadc6815cf8f4559b43cc11c1958f0622d628d1d7dfd6eb655e940a
-
SSDEEP
12288:Z0oQRsVUoS1TNFvfjBdDPS6TdauPQYCuu1IshXzlGdv1BsHT0NbsuC:+fRPh1xFvbbD/Y1ws1zSv1BsHT0NIX
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4908 wrote to memory of 1468 4908 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 85 PID 4908 wrote to memory of 1468 4908 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 85 PID 4908 wrote to memory of 1468 4908 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 85 PID 1468 wrote to memory of 2364 1468 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 89 PID 1468 wrote to memory of 2364 1468 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 89 PID 1468 wrote to memory of 2364 1468 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 89 PID 2364 wrote to memory of 5008 2364 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 90 PID 2364 wrote to memory of 5008 2364 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 90 PID 2364 wrote to memory of 5008 2364 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 90 PID 5008 wrote to memory of 3532 5008 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 91 PID 5008 wrote to memory of 3532 5008 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 91 PID 5008 wrote to memory of 3532 5008 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 91 PID 3532 wrote to memory of 4980 3532 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 92 PID 3532 wrote to memory of 4980 3532 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 92 PID 3532 wrote to memory of 4980 3532 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 92 PID 4980 wrote to memory of 2024 4980 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 93 PID 4980 wrote to memory of 2024 4980 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 93 PID 4980 wrote to memory of 2024 4980 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 93 PID 2024 wrote to memory of 4068 2024 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 94 PID 2024 wrote to memory of 4068 2024 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 94 PID 2024 wrote to memory of 4068 2024 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 94 PID 4068 wrote to memory of 660 4068 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 95 PID 4068 wrote to memory of 660 4068 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 95 PID 4068 wrote to memory of 660 4068 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 95 PID 660 wrote to memory of 4328 660 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 96 PID 660 wrote to memory of 4328 660 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 96 PID 660 wrote to memory of 4328 660 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 96 PID 4328 wrote to memory of 3572 4328 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 97 PID 4328 wrote to memory of 3572 4328 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 97 PID 4328 wrote to memory of 3572 4328 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 97 PID 3572 wrote to memory of 3188 3572 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 98 PID 3572 wrote to memory of 3188 3572 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 98 PID 3572 wrote to memory of 3188 3572 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 98 PID 3188 wrote to memory of 5048 3188 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 99 PID 3188 wrote to memory of 5048 3188 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 99 PID 3188 wrote to memory of 5048 3188 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 99 PID 5048 wrote to memory of 4284 5048 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 100 PID 5048 wrote to memory of 4284 5048 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 100 PID 5048 wrote to memory of 4284 5048 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 100 PID 4284 wrote to memory of 1084 4284 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 101 PID 4284 wrote to memory of 1084 4284 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 101 PID 4284 wrote to memory of 1084 4284 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 101 PID 1084 wrote to memory of 3780 1084 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 102 PID 1084 wrote to memory of 3780 1084 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 102 PID 1084 wrote to memory of 3780 1084 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 102 PID 3780 wrote to memory of 2236 3780 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 103 PID 3780 wrote to memory of 2236 3780 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 103 PID 3780 wrote to memory of 2236 3780 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 103 PID 2236 wrote to memory of 2296 2236 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 104 PID 2236 wrote to memory of 2296 2236 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 104 PID 2236 wrote to memory of 2296 2236 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 104 PID 2296 wrote to memory of 2308 2296 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 105 PID 2296 wrote to memory of 2308 2296 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 105 PID 2296 wrote to memory of 2308 2296 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 105 PID 2308 wrote to memory of 4924 2308 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 106 PID 2308 wrote to memory of 4924 2308 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 106 PID 2308 wrote to memory of 4924 2308 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 106 PID 4924 wrote to memory of 4344 4924 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 107 PID 4924 wrote to memory of 4344 4924 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 107 PID 4924 wrote to memory of 4344 4924 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 107 PID 4344 wrote to memory of 3156 4344 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 108 PID 4344 wrote to memory of 3156 4344 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 108 PID 4344 wrote to memory of 3156 4344 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 108 PID 3156 wrote to memory of 3244 3156 b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"9⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"11⤵
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"13⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"14⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"16⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"17⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"19⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"20⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"21⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"22⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"23⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"24⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"25⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"26⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"27⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"28⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"29⤵
- Checks computer location settings
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"30⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"31⤵
- System Location Discovery: System Language Discovery
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"32⤵
- System Location Discovery: System Language Discovery
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"33⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"34⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"35⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"36⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"37⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"38⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"39⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"40⤵
- Checks computer location settings
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"41⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"42⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"43⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"44⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"45⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"46⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"47⤵
- Checks computer location settings
PID:432 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"48⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"49⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"50⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"51⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"52⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"53⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"54⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"55⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"56⤵
- System Location Discovery: System Language Discovery
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"57⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"58⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"59⤵
- System Location Discovery: System Language Discovery
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"60⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"61⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"62⤵
- Checks computer location settings
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"63⤵
- Checks computer location settings
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"64⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"65⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"66⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"67⤵
- Checks computer location settings
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"68⤵
- Checks computer location settings
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"69⤵
- System Location Discovery: System Language Discovery
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"70⤵
- Checks computer location settings
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"71⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"72⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"73⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"74⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"75⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"76⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"77⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"78⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"79⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"80⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"81⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"82⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"83⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"84⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"85⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"86⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"87⤵
- Checks computer location settings
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"88⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"89⤵
- Checks computer location settings
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"90⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"91⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"92⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"93⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"94⤵
- Checks computer location settings
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"95⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"96⤵
- Checks computer location settings
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"97⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"98⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"99⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"100⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"101⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"102⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"103⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"104⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"105⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"106⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"107⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"108⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"109⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"110⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"111⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"112⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"113⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"114⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"115⤵
- System Location Discovery: System Language Discovery
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"116⤵
- System Location Discovery: System Language Discovery
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"117⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"118⤵
- Checks computer location settings
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"119⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"120⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"121⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b39838fbc2ad08718f1a6a5a6348e9d6_JaffaCakes118.exe"122⤵PID:1068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-