Analysis
-
max time kernel
50s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-09-2024 23:41
Static task
static1
Behavioral task
behavioral1
Sample
d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe
-
Size
282KB
-
MD5
d747f1d49e132eb6616747403592ab27
-
SHA1
4d0ab11be2827b300d2bc9b6c8450c098c060fd7
-
SHA256
60c837e01b02be312c1b1a1135d07fe3ced04e04c5390f7afe7b2f85cb233943
-
SHA512
2041151d38cd26142616f120f69671c98af03823bfc2d7b45f35e010110c25180a04c14656ef711fc52a668de2865dfb8ab846759fb5f0952a0ca86f137df28e
-
SSDEEP
6144:QCQfM0GU7vTAqHc0WSuzQbI7KZJUpmkLO8xiyQvs3Ccnt2j75LbGRXOk+lcjkrEi:wKM/KM7
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2052 2972 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 30 PID 2972 wrote to memory of 2052 2972 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 30 PID 2972 wrote to memory of 2052 2972 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 30 PID 2972 wrote to memory of 2052 2972 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 30 PID 2052 wrote to memory of 2148 2052 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 31 PID 2052 wrote to memory of 2148 2052 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 31 PID 2052 wrote to memory of 2148 2052 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 31 PID 2052 wrote to memory of 2148 2052 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 31 PID 2148 wrote to memory of 2452 2148 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 32 PID 2148 wrote to memory of 2452 2148 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 32 PID 2148 wrote to memory of 2452 2148 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 32 PID 2148 wrote to memory of 2452 2148 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 32 PID 2452 wrote to memory of 2884 2452 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 33 PID 2452 wrote to memory of 2884 2452 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 33 PID 2452 wrote to memory of 2884 2452 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 33 PID 2452 wrote to memory of 2884 2452 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 33 PID 2884 wrote to memory of 2876 2884 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 34 PID 2884 wrote to memory of 2876 2884 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 34 PID 2884 wrote to memory of 2876 2884 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 34 PID 2884 wrote to memory of 2876 2884 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 34 PID 2876 wrote to memory of 2720 2876 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 35 PID 2876 wrote to memory of 2720 2876 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 35 PID 2876 wrote to memory of 2720 2876 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 35 PID 2876 wrote to memory of 2720 2876 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 35 PID 2720 wrote to memory of 2580 2720 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 36 PID 2720 wrote to memory of 2580 2720 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 36 PID 2720 wrote to memory of 2580 2720 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 36 PID 2720 wrote to memory of 2580 2720 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 36 PID 2580 wrote to memory of 2204 2580 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 37 PID 2580 wrote to memory of 2204 2580 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 37 PID 2580 wrote to memory of 2204 2580 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 37 PID 2580 wrote to memory of 2204 2580 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 37 PID 2204 wrote to memory of 2400 2204 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 38 PID 2204 wrote to memory of 2400 2204 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 38 PID 2204 wrote to memory of 2400 2204 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 38 PID 2204 wrote to memory of 2400 2204 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 38 PID 2400 wrote to memory of 1936 2400 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 39 PID 2400 wrote to memory of 1936 2400 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 39 PID 2400 wrote to memory of 1936 2400 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 39 PID 2400 wrote to memory of 1936 2400 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 39 PID 1936 wrote to memory of 1676 1936 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 40 PID 1936 wrote to memory of 1676 1936 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 40 PID 1936 wrote to memory of 1676 1936 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 40 PID 1936 wrote to memory of 1676 1936 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 40 PID 1676 wrote to memory of 1428 1676 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 41 PID 1676 wrote to memory of 1428 1676 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 41 PID 1676 wrote to memory of 1428 1676 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 41 PID 1676 wrote to memory of 1428 1676 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 41 PID 1428 wrote to memory of 1468 1428 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 42 PID 1428 wrote to memory of 1468 1428 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 42 PID 1428 wrote to memory of 1468 1428 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 42 PID 1428 wrote to memory of 1468 1428 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 42 PID 1468 wrote to memory of 1900 1468 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 43 PID 1468 wrote to memory of 1900 1468 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 43 PID 1468 wrote to memory of 1900 1468 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 43 PID 1468 wrote to memory of 1900 1468 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 43 PID 1900 wrote to memory of 2796 1900 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 44 PID 1900 wrote to memory of 2796 1900 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 44 PID 1900 wrote to memory of 2796 1900 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 44 PID 1900 wrote to memory of 2796 1900 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 44 PID 2796 wrote to memory of 2212 2796 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 45 PID 2796 wrote to memory of 2212 2796 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 45 PID 2796 wrote to memory of 2212 2796 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 45 PID 2796 wrote to memory of 2212 2796 d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"9⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"11⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"12⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"13⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"14⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"16⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"17⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"18⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"19⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"20⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"21⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"22⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"23⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"24⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"25⤵
- System Location Discovery: System Language Discovery
PID:796 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"26⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"27⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"28⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"29⤵
- System Location Discovery: System Language Discovery
PID:904 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"30⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"31⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"32⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"33⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"34⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"35⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"36⤵
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"37⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"38⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"39⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"40⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"41⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"42⤵
- System Location Discovery: System Language Discovery
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"43⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"44⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"45⤵
- System Location Discovery: System Language Discovery
PID:580 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"46⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"47⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"48⤵
- System Location Discovery: System Language Discovery
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"49⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"50⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"51⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"52⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"53⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"54⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"55⤵
- System Location Discovery: System Language Discovery
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"56⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"57⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"58⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"59⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"60⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"61⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"62⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"63⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"64⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"65⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"66⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"67⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"68⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"69⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"70⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"71⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"72⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"73⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"74⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"75⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"76⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"77⤵
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"78⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"79⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"80⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"81⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"82⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"83⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"84⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"85⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"86⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"87⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"88⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"89⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"90⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"91⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"92⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"93⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"94⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"95⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"96⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"97⤵
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"98⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"99⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"100⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"101⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"102⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"103⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"104⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"105⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"106⤵
- System Location Discovery: System Language Discovery
PID:380 -
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"107⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"108⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"109⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"110⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"111⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"112⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"113⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"114⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"115⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"116⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"117⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"118⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"119⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"120⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"121⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d747f1d49e132eb6616747403592ab27_JaffaCakes118.exe"122⤵PID:2740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-