Analysis
-
max time kernel
53s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-10-2024 20:27
Static task
static1
Behavioral task
behavioral1
Sample
1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe
-
Size
5.5MB
-
MD5
1066e38671a513d86cd9b1675197fef9
-
SHA1
4a5b1a027e868de92cbfe1e6395047b51b25eec8
-
SHA256
4d4749f98293e13a192d320fd170196f813653e6595ceeea5f593c546a1b5d3d
-
SHA512
52f6f5d7ebbb5630178449f42b611b48fe006b78e733ea4c15d4e707b70716ad77decb091481b95387386ac0f41d7f588d97235dbb90399468b9af5e3b0764fb
-
SSDEEP
98304:mcdDtoHHHwd6G3mhyMmKclet2pxqXmbHbVbiy+MzSuIU7KS3NYqQI:JDeg6G2hyM9ckt2vqXmtiydSxU7KGYqf
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2664 2156 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 30 PID 2156 wrote to memory of 2664 2156 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 30 PID 2156 wrote to memory of 2664 2156 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 30 PID 2156 wrote to memory of 2664 2156 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 30 PID 2664 wrote to memory of 2336 2664 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 31 PID 2664 wrote to memory of 2336 2664 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 31 PID 2664 wrote to memory of 2336 2664 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 31 PID 2664 wrote to memory of 2336 2664 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 31 PID 2336 wrote to memory of 2452 2336 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 32 PID 2336 wrote to memory of 2452 2336 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 32 PID 2336 wrote to memory of 2452 2336 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 32 PID 2336 wrote to memory of 2452 2336 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 32 PID 2452 wrote to memory of 2448 2452 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 33 PID 2452 wrote to memory of 2448 2452 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 33 PID 2452 wrote to memory of 2448 2452 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 33 PID 2452 wrote to memory of 2448 2452 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 33 PID 2448 wrote to memory of 2964 2448 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 34 PID 2448 wrote to memory of 2964 2448 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 34 PID 2448 wrote to memory of 2964 2448 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 34 PID 2448 wrote to memory of 2964 2448 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 34 PID 2964 wrote to memory of 2696 2964 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 35 PID 2964 wrote to memory of 2696 2964 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 35 PID 2964 wrote to memory of 2696 2964 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 35 PID 2964 wrote to memory of 2696 2964 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 35 PID 2696 wrote to memory of 2648 2696 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 36 PID 2696 wrote to memory of 2648 2696 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 36 PID 2696 wrote to memory of 2648 2696 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 36 PID 2696 wrote to memory of 2648 2696 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 36 PID 2648 wrote to memory of 1912 2648 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 37 PID 2648 wrote to memory of 1912 2648 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 37 PID 2648 wrote to memory of 1912 2648 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 37 PID 2648 wrote to memory of 1912 2648 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 37 PID 1912 wrote to memory of 1284 1912 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 38 PID 1912 wrote to memory of 1284 1912 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 38 PID 1912 wrote to memory of 1284 1912 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 38 PID 1912 wrote to memory of 1284 1912 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 38 PID 1284 wrote to memory of 1388 1284 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 39 PID 1284 wrote to memory of 1388 1284 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 39 PID 1284 wrote to memory of 1388 1284 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 39 PID 1284 wrote to memory of 1388 1284 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 39 PID 1388 wrote to memory of 1800 1388 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 40 PID 1388 wrote to memory of 1800 1388 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 40 PID 1388 wrote to memory of 1800 1388 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 40 PID 1388 wrote to memory of 1800 1388 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 40 PID 1800 wrote to memory of 1980 1800 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 41 PID 1800 wrote to memory of 1980 1800 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 41 PID 1800 wrote to memory of 1980 1800 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 41 PID 1800 wrote to memory of 1980 1800 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 41 PID 1980 wrote to memory of 632 1980 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 42 PID 1980 wrote to memory of 632 1980 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 42 PID 1980 wrote to memory of 632 1980 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 42 PID 1980 wrote to memory of 632 1980 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 42 PID 632 wrote to memory of 2684 632 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 71 PID 632 wrote to memory of 2684 632 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 71 PID 632 wrote to memory of 2684 632 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 71 PID 632 wrote to memory of 2684 632 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 71 PID 2684 wrote to memory of 2424 2684 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 44 PID 2684 wrote to memory of 2424 2684 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 44 PID 2684 wrote to memory of 2424 2684 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 44 PID 2684 wrote to memory of 2424 2684 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 44 PID 2424 wrote to memory of 1688 2424 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 73 PID 2424 wrote to memory of 1688 2424 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 73 PID 2424 wrote to memory of 1688 2424 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 73 PID 2424 wrote to memory of 1688 2424 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"9⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"11⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"12⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"13⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"14⤵
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"16⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"17⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"18⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"19⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"20⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"21⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"22⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"23⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"24⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"25⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"26⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"27⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"28⤵
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"29⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"30⤵
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"31⤵
- System Location Discovery: System Language Discovery
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"32⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"33⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"34⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"35⤵
- System Location Discovery: System Language Discovery
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"36⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"37⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"38⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"39⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"40⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"41⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"42⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"43⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"44⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"45⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"46⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"47⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"48⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"49⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"50⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"51⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"52⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"53⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"54⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"55⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"56⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"57⤵
- System Location Discovery: System Language Discovery
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"58⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"59⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"60⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"61⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"62⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"63⤵
- System Location Discovery: System Language Discovery
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"64⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"65⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"66⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"67⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"68⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"69⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"70⤵
- System Location Discovery: System Language Discovery
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"71⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"72⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"73⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"74⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"75⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"76⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"77⤵
- System Location Discovery: System Language Discovery
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"78⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"79⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"80⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"81⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"82⤵
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"83⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"84⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"85⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"86⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"87⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"88⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"89⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"90⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"91⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"92⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"93⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"94⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"95⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"96⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"97⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"98⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"99⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"100⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"101⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"102⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"103⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"104⤵
- System Location Discovery: System Language Discovery
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"105⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"106⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"107⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"108⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"109⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"110⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"111⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"112⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"113⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"114⤵
- System Location Discovery: System Language Discovery
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"115⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"116⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"117⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"118⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"119⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"120⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"121⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"122⤵PID:2000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-