Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
67s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe
-
Size
5.5MB
-
MD5
1066e38671a513d86cd9b1675197fef9
-
SHA1
4a5b1a027e868de92cbfe1e6395047b51b25eec8
-
SHA256
4d4749f98293e13a192d320fd170196f813653e6595ceeea5f593c546a1b5d3d
-
SHA512
52f6f5d7ebbb5630178449f42b611b48fe006b78e733ea4c15d4e707b70716ad77decb091481b95387386ac0f41d7f588d97235dbb90399468b9af5e3b0764fb
-
SSDEEP
98304:mcdDtoHHHwd6G3mhyMmKclet2pxqXmbHbVbiy+MzSuIU7KS3NYqQI:JDeg6G2hyM9ckt2vqXmtiydSxU7KGYqf
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3176 wrote to memory of 3508 3176 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 83 PID 3176 wrote to memory of 3508 3176 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 83 PID 3176 wrote to memory of 3508 3176 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 83 PID 3508 wrote to memory of 4376 3508 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 84 PID 3508 wrote to memory of 4376 3508 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 84 PID 3508 wrote to memory of 4376 3508 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 84 PID 4376 wrote to memory of 4996 4376 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 85 PID 4376 wrote to memory of 4996 4376 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 85 PID 4376 wrote to memory of 4996 4376 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 85 PID 4996 wrote to memory of 3852 4996 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 86 PID 4996 wrote to memory of 3852 4996 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 86 PID 4996 wrote to memory of 3852 4996 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 86 PID 3852 wrote to memory of 1852 3852 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 87 PID 3852 wrote to memory of 1852 3852 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 87 PID 3852 wrote to memory of 1852 3852 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 87 PID 1852 wrote to memory of 1520 1852 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 88 PID 1852 wrote to memory of 1520 1852 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 88 PID 1852 wrote to memory of 1520 1852 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 88 PID 1520 wrote to memory of 2200 1520 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 89 PID 1520 wrote to memory of 2200 1520 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 89 PID 1520 wrote to memory of 2200 1520 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 89 PID 2200 wrote to memory of 2600 2200 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 90 PID 2200 wrote to memory of 2600 2200 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 90 PID 2200 wrote to memory of 2600 2200 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 90 PID 2600 wrote to memory of 2016 2600 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 91 PID 2600 wrote to memory of 2016 2600 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 91 PID 2600 wrote to memory of 2016 2600 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 91 PID 2016 wrote to memory of 4084 2016 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 92 PID 2016 wrote to memory of 4084 2016 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 92 PID 2016 wrote to memory of 4084 2016 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 92 PID 4084 wrote to memory of 3240 4084 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 93 PID 4084 wrote to memory of 3240 4084 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 93 PID 4084 wrote to memory of 3240 4084 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 93 PID 3240 wrote to memory of 3048 3240 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 94 PID 3240 wrote to memory of 3048 3240 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 94 PID 3240 wrote to memory of 3048 3240 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 94 PID 3048 wrote to memory of 4368 3048 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 95 PID 3048 wrote to memory of 4368 3048 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 95 PID 3048 wrote to memory of 4368 3048 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 95 PID 4368 wrote to memory of 3140 4368 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 96 PID 4368 wrote to memory of 3140 4368 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 96 PID 4368 wrote to memory of 3140 4368 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 96 PID 3140 wrote to memory of 3456 3140 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 97 PID 3140 wrote to memory of 3456 3140 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 97 PID 3140 wrote to memory of 3456 3140 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 97 PID 3456 wrote to memory of 4956 3456 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 98 PID 3456 wrote to memory of 4956 3456 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 98 PID 3456 wrote to memory of 4956 3456 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 98 PID 4956 wrote to memory of 2692 4956 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 99 PID 4956 wrote to memory of 2692 4956 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 99 PID 4956 wrote to memory of 2692 4956 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 99 PID 2692 wrote to memory of 4092 2692 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 132 PID 2692 wrote to memory of 4092 2692 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 132 PID 2692 wrote to memory of 4092 2692 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 132 PID 4092 wrote to memory of 4156 4092 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 101 PID 4092 wrote to memory of 4156 4092 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 101 PID 4092 wrote to memory of 4156 4092 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 101 PID 4156 wrote to memory of 2304 4156 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 102 PID 4156 wrote to memory of 2304 4156 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 102 PID 4156 wrote to memory of 2304 4156 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 102 PID 2304 wrote to memory of 1772 2304 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 103 PID 2304 wrote to memory of 1772 2304 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 103 PID 2304 wrote to memory of 1772 2304 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 103 PID 1772 wrote to memory of 5104 1772 1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"9⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"11⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"13⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"14⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"16⤵
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"17⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"18⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"19⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"20⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"21⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"22⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"23⤵
- System Location Discovery: System Language Discovery
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"24⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"25⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"26⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"27⤵
- Checks computer location settings
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"28⤵
- Checks computer location settings
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"29⤵
- System Location Discovery: System Language Discovery
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"30⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"31⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"32⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"33⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"34⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"35⤵
- Checks computer location settings
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"36⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"37⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"38⤵
- Checks computer location settings
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"39⤵
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"40⤵
- System Location Discovery: System Language Discovery
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"41⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"42⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"43⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"44⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"45⤵
- Checks computer location settings
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"46⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"47⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"48⤵
- System Location Discovery: System Language Discovery
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"49⤵
- System Location Discovery: System Language Discovery
PID:868 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"50⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"51⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"52⤵
- Checks computer location settings
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"53⤵
- Checks computer location settings
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"54⤵
- System Location Discovery: System Language Discovery
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"55⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"56⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"57⤵
- System Location Discovery: System Language Discovery
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"58⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"59⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"60⤵
- Checks computer location settings
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"61⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"62⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"63⤵
- Checks computer location settings
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"64⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"65⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"66⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"67⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"68⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"69⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"70⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"71⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"72⤵
- System Location Discovery: System Language Discovery
PID:412 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"73⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"74⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"75⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"76⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"77⤵
- Checks computer location settings
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"78⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"79⤵
- System Location Discovery: System Language Discovery
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"80⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"81⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"82⤵
- Checks computer location settings
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"83⤵
- System Location Discovery: System Language Discovery
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"84⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"85⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"86⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"87⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"88⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"89⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"90⤵
- Checks computer location settings
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"91⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"92⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"93⤵
- Checks computer location settings
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"94⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"95⤵
- System Location Discovery: System Language Discovery
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"96⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"97⤵
- System Location Discovery: System Language Discovery
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"98⤵
- Checks computer location settings
PID:412 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"99⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"100⤵
- Checks computer location settings
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"101⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"102⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"103⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"104⤵
- Checks computer location settings
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"105⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"106⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"107⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"108⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"109⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"110⤵
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"111⤵
- System Location Discovery: System Language Discovery
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"112⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"113⤵
- Checks computer location settings
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"114⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"115⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"116⤵
- Checks computer location settings
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"117⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"118⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"119⤵
- System Location Discovery: System Language Discovery
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"120⤵
- System Location Discovery: System Language Discovery
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"121⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1066e38671a513d86cd9b1675197fef9_JaffaCakes118.exe"122⤵PID:1216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-