Analysis
-
max time kernel
42s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 02:45
Static task
static1
Behavioral task
behavioral1
Sample
11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe
-
Size
2.8MB
-
MD5
11826520a7ac15adfbc4211a46576569
-
SHA1
33c747ba6601283d699a41149504aeca0b3ebcb8
-
SHA256
862b45e201bf7a3e964a6cfc1d0e0d17ef32d9d2558e6630143d7d30f714e2aa
-
SHA512
358bf73ad58d4aadf5adf35e57175e701128db8239f40bf0879eadab80db1be92809c5faa0f346b964e6809aa71b03268021ef805064608a05a7455fb41c62bb
-
SSDEEP
49152:IlOkFPal4p/b5m0jWmtlV8G8zkgNA5k/kpE+VOasY6DwOBfrnvV7UeWtN/:MDFjpcoj6rzZNA2/O6YiwOBpIeWb
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2812 3020 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 30 PID 3020 wrote to memory of 2812 3020 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 30 PID 3020 wrote to memory of 2812 3020 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 30 PID 3020 wrote to memory of 2812 3020 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 30 PID 2812 wrote to memory of 2872 2812 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 31 PID 2812 wrote to memory of 2872 2812 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 31 PID 2812 wrote to memory of 2872 2812 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 31 PID 2812 wrote to memory of 2872 2812 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 31 PID 2872 wrote to memory of 2444 2872 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 32 PID 2872 wrote to memory of 2444 2872 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 32 PID 2872 wrote to memory of 2444 2872 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 32 PID 2872 wrote to memory of 2444 2872 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 32 PID 2444 wrote to memory of 2068 2444 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 33 PID 2444 wrote to memory of 2068 2444 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 33 PID 2444 wrote to memory of 2068 2444 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 33 PID 2444 wrote to memory of 2068 2444 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 33 PID 2068 wrote to memory of 1664 2068 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 34 PID 2068 wrote to memory of 1664 2068 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 34 PID 2068 wrote to memory of 1664 2068 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 34 PID 2068 wrote to memory of 1664 2068 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 34 PID 1664 wrote to memory of 2284 1664 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 35 PID 1664 wrote to memory of 2284 1664 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 35 PID 1664 wrote to memory of 2284 1664 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 35 PID 1664 wrote to memory of 2284 1664 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 35 PID 2284 wrote to memory of 2660 2284 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 36 PID 2284 wrote to memory of 2660 2284 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 36 PID 2284 wrote to memory of 2660 2284 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 36 PID 2284 wrote to memory of 2660 2284 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 36 PID 2660 wrote to memory of 2912 2660 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 37 PID 2660 wrote to memory of 2912 2660 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 37 PID 2660 wrote to memory of 2912 2660 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 37 PID 2660 wrote to memory of 2912 2660 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 37 PID 2912 wrote to memory of 2192 2912 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 38 PID 2912 wrote to memory of 2192 2912 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 38 PID 2912 wrote to memory of 2192 2912 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 38 PID 2912 wrote to memory of 2192 2912 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 38 PID 2192 wrote to memory of 2372 2192 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 39 PID 2192 wrote to memory of 2372 2192 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 39 PID 2192 wrote to memory of 2372 2192 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 39 PID 2192 wrote to memory of 2372 2192 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 39 PID 2372 wrote to memory of 2416 2372 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 40 PID 2372 wrote to memory of 2416 2372 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 40 PID 2372 wrote to memory of 2416 2372 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 40 PID 2372 wrote to memory of 2416 2372 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 40 PID 2416 wrote to memory of 2488 2416 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 41 PID 2416 wrote to memory of 2488 2416 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 41 PID 2416 wrote to memory of 2488 2416 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 41 PID 2416 wrote to memory of 2488 2416 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 41 PID 2488 wrote to memory of 1648 2488 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 42 PID 2488 wrote to memory of 1648 2488 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 42 PID 2488 wrote to memory of 1648 2488 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 42 PID 2488 wrote to memory of 1648 2488 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 42 PID 1648 wrote to memory of 352 1648 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 68 PID 1648 wrote to memory of 352 1648 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 68 PID 1648 wrote to memory of 352 1648 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 68 PID 1648 wrote to memory of 352 1648 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 68 PID 352 wrote to memory of 828 352 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 44 PID 352 wrote to memory of 828 352 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 44 PID 352 wrote to memory of 828 352 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 44 PID 352 wrote to memory of 828 352 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 44 PID 828 wrote to memory of 1844 828 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 45 PID 828 wrote to memory of 1844 828 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 45 PID 828 wrote to memory of 1844 828 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 45 PID 828 wrote to memory of 1844 828 11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"9⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"11⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"12⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"14⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"17⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"18⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"19⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"20⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"21⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"22⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"23⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"24⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"25⤵
- System Location Discovery: System Language Discovery
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"26⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"27⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"28⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"29⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"30⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"31⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"32⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"33⤵
- System Location Discovery: System Language Discovery
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"34⤵
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"35⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"36⤵
- System Location Discovery: System Language Discovery
PID:860 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"37⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"38⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"39⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"40⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"41⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"42⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"43⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"44⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"45⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"46⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"47⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"48⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"49⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"50⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"51⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"52⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"53⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"54⤵
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"55⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"56⤵
- System Location Discovery: System Language Discovery
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"57⤵
- System Location Discovery: System Language Discovery
PID:288 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"58⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"59⤵
- System Location Discovery: System Language Discovery
PID:480 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"60⤵
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"61⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"62⤵
- System Location Discovery: System Language Discovery
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"63⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"64⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"65⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"66⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"67⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"68⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"69⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"70⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"71⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"72⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"73⤵
- System Location Discovery: System Language Discovery
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"74⤵
- System Location Discovery: System Language Discovery
PID:348 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"75⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"76⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"77⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"78⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"79⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"80⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"81⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"82⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"83⤵
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"84⤵
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"85⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"86⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"87⤵
- System Location Discovery: System Language Discovery
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"88⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"89⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"90⤵
- System Location Discovery: System Language Discovery
PID:404 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"91⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"92⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"93⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"94⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"95⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"96⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"97⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"98⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"99⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"100⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"101⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"102⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"103⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"104⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"105⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"106⤵
- System Location Discovery: System Language Discovery
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"107⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"108⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"109⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"110⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"111⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"112⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"113⤵
- System Location Discovery: System Language Discovery
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"114⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"115⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"116⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"117⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"118⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"119⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"120⤵
- System Location Discovery: System Language Discovery
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"121⤵
- System Location Discovery: System Language Discovery
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11826520a7ac15adfbc4211a46576569_JaffaCakes118.exe"122⤵PID:1068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-