Overview

overview

7

Static

static

3

39b5065b07...18.exe

windows7-x64

7

39b5065b07...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    15s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2024 11:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    39b5065b0729aaea67075e1ef3ae1763

  • SHA1

    10393d80ea0fbea8438dfa641cc1303632d3eb77

  • SHA256

    7c62584469ed5beb83cefcd253db91ac7a05fe64dfde243e38fdf458d2cfc82d

  • SHA512

    af480b08a8ec8a39efac94c562bb88d0aaf3ba06f11cfaf26edce507141d4606bed6da5b37aab89f2b636aaecda60a0f4ea27155bb32c2ac0581f15ad98a8fb5

  • SSDEEP

    24576:2WjI0DtCJZKU7A9pIfcewtCAI4kR9Rkuhh6wryFR:z80D4h71aHI4kRrbhh6wWD

Score
7/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:412
    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5008
      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:388
        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3872
          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
            5⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4508
            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
              6⤵
                PID:852
                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                  7⤵
                    PID:5648
                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                      8⤵
                        PID:9200
                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                          9⤵
                            PID:19380
                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                          8⤵
                            PID:12172
                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                            8⤵
                              PID:13948
                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                              8⤵
                                PID:19112
                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                              7⤵
                                PID:7084
                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                  8⤵
                                    PID:15504
                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                    8⤵
                                      PID:5964
                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                    7⤵
                                      PID:9516
                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                        8⤵
                                          PID:19332
                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                        7⤵
                                          PID:16076
                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                          7⤵
                                            PID:14904
                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                          6⤵
                                            PID:4296
                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                              7⤵
                                                PID:8920
                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                7⤵
                                                  PID:11980
                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                  7⤵
                                                    PID:14028
                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                    7⤵
                                                      PID:18176
                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                    6⤵
                                                      PID:5992
                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                        7⤵
                                                          PID:11208
                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                          7⤵
                                                            PID:14196
                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                            7⤵
                                                              PID:19216
                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                            6⤵
                                                              PID:7956
                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                              6⤵
                                                                PID:11360
                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                6⤵
                                                                  PID:14380
                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                  6⤵
                                                                    PID:18976
                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                  5⤵
                                                                    PID:1100
                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                      6⤵
                                                                        PID:5712
                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                          7⤵
                                                                            PID:9000
                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                              8⤵
                                                                                PID:19348
                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                              7⤵
                                                                                PID:12128
                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                7⤵
                                                                                  PID:13980
                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                  7⤵
                                                                                    PID:19144
                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                  6⤵
                                                                                    PID:7136
                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                      7⤵
                                                                                        PID:15548
                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                        7⤵
                                                                                          PID:19056
                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                        6⤵
                                                                                          PID:9900
                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                          6⤵
                                                                                            PID:15740
                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                            6⤵
                                                                                              PID:19264
                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                            5⤵
                                                                                              PID:4928
                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                6⤵
                                                                                                  PID:8980
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                    7⤵
                                                                                                      PID:21248
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                    6⤵
                                                                                                      PID:11996
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                      6⤵
                                                                                                        PID:13852
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                        6⤵
                                                                                                          PID:18104
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                        5⤵
                                                                                                          PID:6024
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                            6⤵
                                                                                                              PID:11216
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                7⤵
                                                                                                                  PID:21240
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                6⤵
                                                                                                                  PID:14188
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                  6⤵
                                                                                                                    PID:19136
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                  5⤵
                                                                                                                    PID:7940
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                      6⤵
                                                                                                                        PID:11020
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                      5⤵
                                                                                                                        PID:11404
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                        5⤵
                                                                                                                          PID:14124
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                          5⤵
                                                                                                                            PID:5876
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                          4⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:2456
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                            5⤵
                                                                                                                              PID:1352
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                6⤵
                                                                                                                                  PID:5544
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                    7⤵
                                                                                                                                      PID:9500
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                        8⤵
                                                                                                                                          PID:19364
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                        7⤵
                                                                                                                                          PID:16084
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                          7⤵
                                                                                                                                            PID:9228
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                          6⤵
                                                                                                                                            PID:6720
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                              7⤵
                                                                                                                                                PID:16012
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                7⤵
                                                                                                                                                  PID:14408
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                6⤵
                                                                                                                                                  PID:9436
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                    7⤵
                                                                                                                                                      PID:21256
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                    6⤵
                                                                                                                                                      PID:15532
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                    5⤵
                                                                                                                                                      PID:3080
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                        6⤵
                                                                                                                                                          PID:8412
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                          6⤵
                                                                                                                                                            PID:11944
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                            6⤵
                                                                                                                                                              PID:13988
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                              6⤵
                                                                                                                                                                PID:18096
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                              5⤵
                                                                                                                                                                PID:6048
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:10864
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                      7⤵
                                                                                                                                                                        PID:19288
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:14372
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:18992
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:7932
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:11600
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:14140
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:6160
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:2904
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:5592
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:8988
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:12028
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:13860
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:5788
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:7100
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:15632
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:19176
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:9720
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:9728
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:16140
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:2192
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:7744
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:4636
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:7172
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:10372
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:19308
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:14832
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:19104
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:6008
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:10844
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:9600
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:15020
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:19032
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:7972
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:15160
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:11388
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:14116
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:7276
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                        PID:4484
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:1692
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:1580
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:5640
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                      PID:9468
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                        PID:16132
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:6932
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                            PID:15996
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                              PID:19192
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:9856
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                  PID:9452
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:15776
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:19072
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                    PID:4184
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:7964
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:11444
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:14100
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:5880
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:6000
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:10884
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                      PID:14472
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:13740
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:19240
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                        PID:7872
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:14468
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                            PID:11628
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:14076
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                PID:20108
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:2016
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:5568
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                      PID:8964
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                        PID:12136
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                          PID:13996
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                            PID:19096
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                            PID:6972
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                PID:15524
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                  PID:19224
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:9884
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                      PID:11028
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:5108
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                        PID:19160
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                        PID:2960
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                            PID:8912
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                              PID:12004
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                PID:13836
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                  PID:18056
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:5968
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                      PID:10900
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                          PID:9512
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                          PID:12536
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                            PID:19232
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                            PID:7808
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                PID:14344
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                PID:10788
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                    PID:19296
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                    PID:14212
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:7364
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                    PID:2828
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4600
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5832
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                PID:9492
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:19724
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:13892
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:18048
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:7092
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:15496
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:19532
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:9712
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:19356
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:16052
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:19048
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3996
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:8944
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:12012
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:13844
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:18080
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5984
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:11224
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:14172
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:19016
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:7856
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:11148
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7888
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:13868
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:18064
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6344
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12624
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13924
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6240
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7108
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:864
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6996
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9892
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:15988
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:19184
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8928
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12108
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:14060
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:20200
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10892
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:14220
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:14984
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7924
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11668
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:14068
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:18152
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:972
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:18136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:16020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:19128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:14636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:19256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:18184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:18072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:14092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:18968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:19324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:15292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:19040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:14540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:14664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:19008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:14012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:18960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:18088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:14148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:18160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:19024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:16068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:19080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:18984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:14388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:14228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:14108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:19152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:21460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:16028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:19064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:16092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:21272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:18028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:14236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:19652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:18016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:21264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:14052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:19000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:16036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:19088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:21232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:16108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:14004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:18120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:19340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:15136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:19200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:14084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:18952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:18144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:16004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:14912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:19372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:16060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:19272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:15628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:14044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:18112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:14204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:14180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:14036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:19208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:18036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:19316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:16100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:14020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:18128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:17232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:19248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:14156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:14312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:18168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:15980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:19168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:16044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:19120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:14164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:19280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:14916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:14132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39b5065b0729aaea67075e1ef3ae1763_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5860

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\gang bang voyeur beautyfull (Kathrin,Gina).rar.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                386KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212f60e51acf0816cdc47a35fd63c4a3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                c2ada6d89b9ea980e4ab075e614c192ce7304827

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                33ec35713ef2f6017a6c6e7d3900ee97c3524961028a0492605d5432d9b4b663

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1bc0aa25d98fa0898f8798e07bd35128da8b18ad56bdcaa0a9b3a7e877a982df0d2c0239352a351000b82cfc806110457f600f35d38cd0e12e2e2b9c06d2861e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\debug.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                146B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                460037a30a7b3bb02989cf290e5a3265

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                08c487ef59aba0598f91ae601f8c591e8d1641b0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                620ccb40bd490231b9666d21cb8084a2d4152e9ac39118e09e510a6d1659a7d0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2468ea5f3e24c05dc9ec5c53d0d7326b7dd4868b503d2b9bb71e179a90a8363f9f3a29e3125dc4ddbd02374b64f6f15382aaf7099745725994bbb803ec722633

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit