Analysis
-
max time kernel
61s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe
-
Size
2.5MB
-
MD5
beee5da88111c7f5dfe582b8f7634142
-
SHA1
8736d3e4082cd4a1796a4f8038cde606140a6ac5
-
SHA256
fbae8a926023f7bf0f62fd60ccb2ac2f9550745170e9f69df66ec2c5b73c966b
-
SHA512
4930320a5d281e457fa70146afdf13a4ebeee2091dc28601fca2b8df8c1319b57b85534d4c0bc7cb604b7da1ecd108892f84ab9b8c09597b908f000e5cb557ab
-
SSDEEP
49152:/tKid8KH5vP5kkxIe9asY6DwOBfrnvV7UeWtcgHoxL:/Lj/ZjYiwOBpIeWugId
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3604 wrote to memory of 548 3604 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 87 PID 3604 wrote to memory of 548 3604 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 87 PID 3604 wrote to memory of 548 3604 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 87 PID 548 wrote to memory of 4772 548 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 88 PID 548 wrote to memory of 4772 548 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 88 PID 548 wrote to memory of 4772 548 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 88 PID 4772 wrote to memory of 3408 4772 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 89 PID 4772 wrote to memory of 3408 4772 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 89 PID 4772 wrote to memory of 3408 4772 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 89 PID 3408 wrote to memory of 4528 3408 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 90 PID 3408 wrote to memory of 4528 3408 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 90 PID 3408 wrote to memory of 4528 3408 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 90 PID 4528 wrote to memory of 3360 4528 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 115 PID 4528 wrote to memory of 3360 4528 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 115 PID 4528 wrote to memory of 3360 4528 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 115 PID 3360 wrote to memory of 3960 3360 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 92 PID 3360 wrote to memory of 3960 3360 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 92 PID 3360 wrote to memory of 3960 3360 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 92 PID 3960 wrote to memory of 4268 3960 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 93 PID 3960 wrote to memory of 4268 3960 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 93 PID 3960 wrote to memory of 4268 3960 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 93 PID 4268 wrote to memory of 4728 4268 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 94 PID 4268 wrote to memory of 4728 4268 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 94 PID 4268 wrote to memory of 4728 4268 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 94 PID 4728 wrote to memory of 2872 4728 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 95 PID 4728 wrote to memory of 2872 4728 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 95 PID 4728 wrote to memory of 2872 4728 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 95 PID 2872 wrote to memory of 1860 2872 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 96 PID 2872 wrote to memory of 1860 2872 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 96 PID 2872 wrote to memory of 1860 2872 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 96 PID 1860 wrote to memory of 1744 1860 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 97 PID 1860 wrote to memory of 1744 1860 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 97 PID 1860 wrote to memory of 1744 1860 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 97 PID 1744 wrote to memory of 2472 1744 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 98 PID 1744 wrote to memory of 2472 1744 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 98 PID 1744 wrote to memory of 2472 1744 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 98 PID 2472 wrote to memory of 2404 2472 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 99 PID 2472 wrote to memory of 2404 2472 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 99 PID 2472 wrote to memory of 2404 2472 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 99 PID 2404 wrote to memory of 1276 2404 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 100 PID 2404 wrote to memory of 1276 2404 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 100 PID 2404 wrote to memory of 1276 2404 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 100 PID 1276 wrote to memory of 4860 1276 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 101 PID 1276 wrote to memory of 4860 1276 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 101 PID 1276 wrote to memory of 4860 1276 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 101 PID 4860 wrote to memory of 2400 4860 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 143 PID 4860 wrote to memory of 2400 4860 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 143 PID 4860 wrote to memory of 2400 4860 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 143 PID 2400 wrote to memory of 3420 2400 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 105 PID 2400 wrote to memory of 3420 2400 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 105 PID 2400 wrote to memory of 3420 2400 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 105 PID 3420 wrote to memory of 3800 3420 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 106 PID 3420 wrote to memory of 3800 3420 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 106 PID 3420 wrote to memory of 3800 3420 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 106 PID 3800 wrote to memory of 3536 3800 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 107 PID 3800 wrote to memory of 3536 3800 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 107 PID 3800 wrote to memory of 3536 3800 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 107 PID 3536 wrote to memory of 2124 3536 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 167 PID 3536 wrote to memory of 2124 3536 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 167 PID 3536 wrote to memory of 2124 3536 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 167 PID 2124 wrote to memory of 3176 2124 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 109 PID 2124 wrote to memory of 3176 2124 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 109 PID 2124 wrote to memory of 3176 2124 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 109 PID 3176 wrote to memory of 3592 3176 beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"6⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"9⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"10⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"11⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"12⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"16⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"17⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"19⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"20⤵
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"21⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"22⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"23⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"24⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"25⤵
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"26⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"27⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"28⤵
- Checks computer location settings
PID:392 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"29⤵
- Checks computer location settings
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"30⤵
- System Location Discovery: System Language Discovery
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"31⤵
- System Location Discovery: System Language Discovery
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"32⤵
- System Location Discovery: System Language Discovery
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"33⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"34⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"35⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"36⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"37⤵
- Checks computer location settings
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"38⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"39⤵
- System Location Discovery: System Language Discovery
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"40⤵
- Checks computer location settings
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"41⤵
- System Location Discovery: System Language Discovery
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"42⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"43⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"44⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"45⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"46⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"47⤵
- System Location Discovery: System Language Discovery
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"48⤵
- Checks computer location settings
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"49⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"50⤵
- System Location Discovery: System Language Discovery
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"51⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"52⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"53⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"54⤵
- System Location Discovery: System Language Discovery
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"55⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"56⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"57⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"58⤵
- Checks computer location settings
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"59⤵
- System Location Discovery: System Language Discovery
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"60⤵
- Checks computer location settings
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"61⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"62⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"63⤵
- System Location Discovery: System Language Discovery
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"64⤵
- System Location Discovery: System Language Discovery
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"65⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"66⤵
- System Location Discovery: System Language Discovery
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"67⤵
- Checks computer location settings
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"68⤵
- System Location Discovery: System Language Discovery
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"69⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"70⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"71⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"72⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"73⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"74⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"75⤵
- Checks computer location settings
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"76⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"77⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"78⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"79⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"80⤵
- Checks computer location settings
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"81⤵
- Checks computer location settings
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"82⤵
- Checks computer location settings
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"83⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"84⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"85⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"86⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"87⤵
- System Location Discovery: System Language Discovery
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"88⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"89⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"90⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"91⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"92⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"93⤵
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"94⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"95⤵
- Checks computer location settings
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"96⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:448 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"97⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"98⤵
- Checks computer location settings
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"99⤵
- System Location Discovery: System Language Discovery
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"100⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"101⤵
- System Location Discovery: System Language Discovery
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"102⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"103⤵
- System Location Discovery: System Language Discovery
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"104⤵
- Checks computer location settings
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"105⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"106⤵
- System Location Discovery: System Language Discovery
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"107⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"108⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"109⤵
- Checks computer location settings
PID:888 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"110⤵
- Checks computer location settings
PID:908 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"111⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"112⤵
- System Location Discovery: System Language Discovery
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"113⤵
- System Location Discovery: System Language Discovery
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"114⤵
- Checks computer location settings
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"115⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"116⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"117⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"118⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"119⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"120⤵
- Checks computer location settings
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"121⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beee5da88111c7f5dfe582b8f7634142_JaffaCakes118.exe"122⤵
- System Location Discovery: System Language Discovery
PID:1444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-