Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
24s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 11:15
Static task
static1
Behavioral task
behavioral1
Sample
39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
39b5065b0729aaea67075e1ef3ae1763
-
SHA1
10393d80ea0fbea8438dfa641cc1303632d3eb77
-
SHA256
7c62584469ed5beb83cefcd253db91ac7a05fe64dfde243e38fdf458d2cfc82d
-
SHA512
af480b08a8ec8a39efac94c562bb88d0aaf3ba06f11cfaf26edce507141d4606bed6da5b37aab89f2b636aaecda60a0f4ea27155bb32c2ac0581f15ad98a8fb5
-
SSDEEP
24576:2WjI0DtCJZKU7A9pIfcewtCAI4kR9Rkuhh6wryFR:z80D4h71aHI4kRrbhh6wWD
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\N: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\G: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\H: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\U: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\W: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\Y: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\Z: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\K: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\M: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\L: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\O: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\P: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\Q: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\V: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\X: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\A: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\B: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\R: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\S: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\T: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\E: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File opened (read-only) \??\J: 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\cumshot [milf] .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\SysWOW64\config\systemprofile\indian trambling hardcore sleeping boobs circumcision .avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\swedish bukkake fetish licking vagina ejaculation .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\Temp\french fetish action sleeping gorgeoushorny .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\SysWOW64\FxsTmp\japanese bukkake masturbation nipples .avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\shared\italian porn kicking licking leather .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\japanese bukkake fetish girls vagina mature .mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\SysWOW64\config\systemprofile\fetish full movie .mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\shared\brasilian horse hot (!) legs (Melissa,Jade).mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\SysWOW64\FxsTmp\french cumshot uncut nipples swallow (Sandy).mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\russian action [free] .mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\blowjob sperm public .zip.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\brasilian bukkake xxx sleeping redhair .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\horse masturbation lady .mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\Download\gay [free] traffic .mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\japanese cumshot bukkake uncut (Sandy,Sarah).rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\french sperm full movie wifey .mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\gay masturbation beautyfull .mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\german xxx bukkake big .mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\fucking cumshot licking (Liz,Liz).mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\african horse cumshot hot (!) vagina .zip.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Program Files\Windows Journal\Templates\indian fucking voyeur swallow (Jade,Sylvia).avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\swedish kicking [milf] .avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Temp\trambling hardcore girls (Tatjana).rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\swedish kicking girls balls .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\handjob [bangbus] vagina (Sonja,Janette).mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\british lingerie catfight wifey .avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\Temp\kicking [milf] (Karin,Britney).avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\african sperm kicking hidden boobs .avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\asian horse full movie .mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\horse girls feet .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\porn fucking licking girly .mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\norwegian cumshot big sweet .avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish bukkake hot (!) swallow .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\SoftwareDistribution\Download\horse horse several models vagina .mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\animal horse licking redhair (Gina,Samantha).mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\gay hot (!) .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\swedish horse full movie .zip.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\tyrkish sperm [milf] titts (Sarah,Tatjana).avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\lingerie kicking hot (!) leather .avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\bukkake beastiality big cock young (Sarah,Sonja).mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\canadian gay girls high heels .zip.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\asian xxx blowjob uncut .mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\russian horse [milf] beautyfull .mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\malaysia bukkake lesbian titts upskirt .zip.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\fetish catfight (Kathrin,Karin).mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\italian xxx [milf] bondage .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\african porn catfight ejaculation .avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\horse voyeur balls .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\chinese beast [milf] blondie .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\german fetish lingerie uncut girly (Sonja).mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\trambling horse full movie .mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\brasilian trambling blowjob hot (!) (Christine).mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\danish sperm trambling public hairy (Sonja).zip.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\horse several models ash stockings .mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\nude catfight glans leather (Gina).rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\chinese nude full movie vagina .avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\chinese cum girls penetration (Ashley,Tatjana).rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\canadian bukkake action girls shoes (Gina,Sonja).mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\tyrkish gay public high heels .mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\black lingerie girls vagina shower .zip.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\animal big .mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\german hardcore cumshot sleeping circumcision .avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\canadian lingerie porn hidden traffic (Karin).rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\norwegian action several models .avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\brasilian fetish girls legs ash (Samantha).mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\assembly\tmp\american horse lesbian ash redhair .mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\Downloaded Program Files\bukkake sperm catfight gorgeoushorny .mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\chinese fucking gay [bangbus] stockings .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\fetish full movie .avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\swedish horse voyeur (Samantha).avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\blowjob horse [bangbus] swallow (Melissa,Sonja).mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\mssrv.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\horse trambling several models cock stockings .avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\french beastiality horse masturbation .mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\horse sleeping bondage (Jenna).mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\kicking horse several models cock ìï .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\handjob handjob uncut castration .mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\french kicking cum uncut ash 40+ .mpg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\horse beastiality [free] pregnant .mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\InstallTemp\action public (Curtney,Janette).mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\beastiality [milf] .avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\swedish trambling masturbation femdom .mpeg.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\animal handjob [bangbus] (Samantha,Christine).rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\fucking lingerie uncut circumcision .zip.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\gang bang animal big fishy (Melissa).avi.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\PLA\Templates\gang bang [bangbus] .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\horse gay catfight legs .rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\action sperm public (Anniston,Liz).rar.exe 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 484 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2292 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1500 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 396 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2740 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 484 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2828 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2292 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2392 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2340 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 600 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1500 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1068 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1724 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 396 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2740 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1908 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1584 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 484 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2612 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2292 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2828 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2100 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2116 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2392 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2380 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2192 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2340 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1500 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 748 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 900 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 600 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 600 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 676 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 676 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2740 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2740 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 396 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 396 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1332 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1332 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1336 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1336 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1860 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1860 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 484 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 484 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1232 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1232 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2388 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 2388 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 960 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 960 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1968 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 1968 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 2804 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 31 PID 2592 wrote to memory of 2804 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 31 PID 2592 wrote to memory of 2804 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 31 PID 2592 wrote to memory of 2804 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 31 PID 2804 wrote to memory of 484 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 32 PID 2804 wrote to memory of 484 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 32 PID 2804 wrote to memory of 484 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 32 PID 2804 wrote to memory of 484 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 32 PID 2592 wrote to memory of 2292 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 33 PID 2592 wrote to memory of 2292 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 33 PID 2592 wrote to memory of 2292 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 33 PID 2592 wrote to memory of 2292 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 33 PID 484 wrote to memory of 1500 484 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 34 PID 484 wrote to memory of 1500 484 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 34 PID 484 wrote to memory of 1500 484 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 34 PID 484 wrote to memory of 1500 484 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 34 PID 2292 wrote to memory of 396 2292 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 35 PID 2292 wrote to memory of 396 2292 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 35 PID 2292 wrote to memory of 396 2292 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 35 PID 2292 wrote to memory of 396 2292 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 35 PID 2804 wrote to memory of 2740 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 36 PID 2804 wrote to memory of 2740 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 36 PID 2804 wrote to memory of 2740 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 36 PID 2804 wrote to memory of 2740 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 36 PID 2592 wrote to memory of 2828 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 37 PID 2592 wrote to memory of 2828 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 37 PID 2592 wrote to memory of 2828 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 37 PID 2592 wrote to memory of 2828 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 37 PID 1500 wrote to memory of 2392 1500 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 38 PID 1500 wrote to memory of 2392 1500 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 38 PID 1500 wrote to memory of 2392 1500 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 38 PID 1500 wrote to memory of 2392 1500 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 38 PID 2740 wrote to memory of 2340 2740 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 39 PID 2740 wrote to memory of 2340 2740 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 39 PID 2740 wrote to memory of 2340 2740 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 39 PID 2740 wrote to memory of 2340 2740 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 39 PID 396 wrote to memory of 600 396 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 40 PID 396 wrote to memory of 600 396 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 40 PID 396 wrote to memory of 600 396 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 40 PID 396 wrote to memory of 600 396 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 40 PID 484 wrote to memory of 1068 484 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 41 PID 484 wrote to memory of 1068 484 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 41 PID 484 wrote to memory of 1068 484 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 41 PID 484 wrote to memory of 1068 484 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 41 PID 2804 wrote to memory of 1724 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 43 PID 2804 wrote to memory of 1724 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 43 PID 2804 wrote to memory of 1724 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 43 PID 2804 wrote to memory of 1724 2804 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 43 PID 2292 wrote to memory of 1908 2292 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 42 PID 2292 wrote to memory of 1908 2292 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 42 PID 2292 wrote to memory of 1908 2292 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 42 PID 2292 wrote to memory of 1908 2292 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 42 PID 2828 wrote to memory of 1584 2828 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 44 PID 2828 wrote to memory of 1584 2828 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 44 PID 2828 wrote to memory of 1584 2828 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 44 PID 2828 wrote to memory of 1584 2828 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 44 PID 2592 wrote to memory of 2612 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 45 PID 2592 wrote to memory of 2612 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 45 PID 2592 wrote to memory of 2612 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 45 PID 2592 wrote to memory of 2612 2592 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 45 PID 2392 wrote to memory of 2100 2392 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 46 PID 2392 wrote to memory of 2100 2392 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 46 PID 2392 wrote to memory of 2100 2392 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 46 PID 2392 wrote to memory of 2100 2392 39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"10⤵PID:11336
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"10⤵PID:21808
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:8144
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"10⤵PID:21108
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:14140
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:9080
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:17236
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:7076
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:21056
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:11712
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:11704
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:17828
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:8196
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:19664
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:17132
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:8980
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:15248
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:7044
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:11600
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:25364
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:11584
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:17788
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:8876
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:16992
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:9740
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:17484
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:7164
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:20936
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:10708
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17316
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:11360
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:5912
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:8908
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17220
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:9680
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17756
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:7304
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:21136
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:11764
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:21792
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:11576
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:8612
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:11608
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:20548
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:9108
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:17324
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:7148
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:21144
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:11664
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:21916
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵
- System Location Discovery: System Language Discovery
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:11552
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:17660
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:8868
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:15272
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:9640
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17372
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:7432
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:11732
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17812
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:13448
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:9172
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:16976
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:9388
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:14132
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:7384
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:11772
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:21784
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:12800
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:9312
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:20488
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17352
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:9856
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17268
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:7616
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:14028
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:7760
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:13936
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:6452
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:16272
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:10228
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17628
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵
- System Location Discovery: System Language Discovery
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:6752
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:16312
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:11288
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:20988
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:11312
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17732
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:8228
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:10748
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17204
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:8852
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17116
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:6960
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:2552
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:10692
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:15012
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:6992
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:5900
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:10732
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17172
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:12784
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:9664
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17524
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:676 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵
- System Location Discovery: System Language Discovery
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:6888
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:10724
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:14908
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:8844
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:15232
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:8884
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:14236
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:6672
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:25568
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:10100
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17540
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:11280
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17684
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:8176
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:10656
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:14220
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:7124
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:4896
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:10740
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17148
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:12776
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:9656
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17276
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:6684
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:16288
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:10092
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17068
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:10628
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17180
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:8184
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:21024
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:14204
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵
- System Location Discovery: System Language Discovery
PID:816 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:11688
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:17820
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:8712
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:25308
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:11568
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:20524
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:9580
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:17448
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:7320
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:11748
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17804
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:11696
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:13196
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:9032
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:13952
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:9588
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17440
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:7424
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:13988
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵
- System Location Discovery: System Language Discovery
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:16436
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:9376
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:14004
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:9996
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:14164
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:7656
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:13912
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:12816
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:9368
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:14212
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:9776
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17636
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:7696
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17212
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:900 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:6384
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:16296
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:10036
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17228
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:11344
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17780
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:8012
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:25420
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:13892
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:6416
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:16376
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:10028
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17308
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:10176
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17564
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:7972
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:13736
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:14188
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:6624
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:16320
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:10220
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17652
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:11352
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:20540
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:8168
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:21036
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:14172
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:6528
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:16328
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:10196
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17612
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:10784
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17604
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:8100
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:21128
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:14156
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:960 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:9616
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17244
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:7408
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:12808
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:8640
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:11616
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17596
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:6816
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:10484
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17556
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:8988
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:15280
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:7036
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:20872
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:11740
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:22916
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:7632
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:14036
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:6268
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:16412
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:9752
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:17516
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:7748
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:25380
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:14228
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:6500
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:16496
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:10044
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17548
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:6784
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:16396
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:10492
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17500
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:11328
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:20496
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:8252
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:11648
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:17644
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:8136
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:19596
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:14148
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:6872
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:15040
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:10516
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:17772
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:7200
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:11592
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:13756
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:9556
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:17284
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:600 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:6180
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"9⤵PID:13800
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:9548
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:17424
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:10444
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:17492
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:7820
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:14012
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:12760
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:9540
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17364
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:9988
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17156
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:7608
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:13960
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵
- System Location Discovery: System Language Discovery
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:6436
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:16464
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:9892
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17700
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:9980
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:14196
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:8028
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17108
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:6348
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:16456
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:10016
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:13884
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:10672
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17724
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:8220
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:23120
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:11672
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:748 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:6508
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"8⤵PID:16368
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:10060
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17076
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:10504
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17508
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:8108
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:13264
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17300
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:6408
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:16488
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:10204
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17668
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:11272
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17880
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:8020
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17060
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵
- System Location Discovery: System Language Discovery
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:6660
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:16352
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:11296
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:21816
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:11560
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17708
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:8292
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:10772
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17196
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:6544
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:16016
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:10052
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17292
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:11320
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:8116
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:20996
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:17036
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:9624
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17416
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:7416
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:13812
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:8000
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17084
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:6700
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:16480
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:10084
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17124
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:9044
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:15768
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:7140
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:10756
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17188
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:7580
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:14268
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:6260
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:16344
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:9800
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:17748
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:8860
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17092
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:6952
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:10764
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17100
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:7296
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:13252
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:11680
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:23204
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:12824
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:9648
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:17404
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:9024
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:14520
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:6928
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:20516
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:11624
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:17740
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:7232
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:16388
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:12832
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:12792
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:9728
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:17572
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:9764
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:17532
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:7312
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:13336
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:11720
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:8156
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"7⤵PID:23216
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17028
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:6792
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:20928
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:11304
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17796
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:9116
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:13920
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:7132
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:16304
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:13972
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:7536
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:14044
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:6252
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:16404
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:9884
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:17620
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:9356
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:14180
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:7156
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:25032
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:11656
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:7964
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:2608
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:14020
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:6584
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:16336
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:10188
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:17676
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:9156
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:21048
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17012
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:7000
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:16360
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:10684
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:15264
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:7552
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:13996
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:6244
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:16448
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:9916
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:17380
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:9572
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"6⤵PID:17764
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:7456
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:11784
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:8620
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:10700
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17252
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:6920
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:20532
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:10524
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:17856
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
PID:284 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:8968
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:13904
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:7008
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:11640
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:21776
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:7592
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:13928
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:6236
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:16420
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:9924
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:17260
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
PID:572 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:9904
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:17388
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:7600
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:13980
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:8340
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:21800
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:11632
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:21760
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:6896
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:21768
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:10716
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:15240
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:9064
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"5⤵PID:16280
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:14916
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:7376
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:11756
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"2⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:7904
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"4⤵PID:19656
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:17044
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"2⤵PID:6608
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"3⤵PID:16048
-
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"2⤵PID:10212
-
-
C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"2⤵PID:17716
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
808KB
MD5b929f864dc28670da42a584dac6d9022
SHA161b2f5d51155c6d4f6710bbda2e1edfb2f2cdebc
SHA256ede1b515ba9390718c1601c9d9faefa2c878e041267494e294c3ecfb0466ec39
SHA512abdb1dceb81ea74c575afb950557473bfe1b544c6f513a265ab2cca76cfecbdbaab75f7d8710c245c3c9ea0a8c81e036bb73837c3dcb47bb21552f0ece526b85
-
Filesize
183B
MD586a2b7343a4187ecb0f9035750eeebc9
SHA184f59811956dbcac803ee665acbc8bea9e8d82b7
SHA25679ed870bf0e8ec25c28aba1d37cf257583daef84076e61b5233ba843525e6d73
SHA51238c0742da79fe17e2dcd52ec118f207d2e003ae811e48955ee49d8d3dd22bafdfb5a77046e5307dd86cae5581444fe310e5a0c79342833c38c7d0900fdce9d55