Overview

overview

7

Static

static

3

66c839f8be...18.exe

windows7-x64

7

66c839f8be...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2024, 13:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
  • Size 1.8MB
  • Sample241021-qa111avbrc
  • SHA256 797404ebc9922b5a37e13f8c99c58949cdd09716abf82b22d1801ae96a1dec68
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3836
    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2828
      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1392
        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4292
          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
            5⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3200
            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3492
              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                7⤵
                  PID:6048
                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                    8⤵
                      PID:11716
                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                      8⤵
                        PID:15804
                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                        8⤵
                          PID:13888
                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                        7⤵
                          PID:6704
                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                            8⤵
                              PID:11748
                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                              8⤵
                                PID:15992
                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                              7⤵
                                PID:9152
                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                  8⤵
                                    PID:15064
                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                    8⤵
                                      PID:22484
                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                    7⤵
                                      PID:11876
                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                      7⤵
                                        PID:16112
                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                      6⤵
                                        PID:4104
                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                          7⤵
                                            PID:9276
                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                              8⤵
                                                PID:15660
                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                8⤵
                                                  PID:22524
                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                7⤵
                                                  PID:11644
                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                  7⤵
                                                    PID:18680
                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                  6⤵
                                                    PID:6828
                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                      7⤵
                                                        PID:12004
                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                        7⤵
                                                          PID:16316
                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                        6⤵
                                                          PID:9200
                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                            7⤵
                                                              PID:15156
                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                              7⤵
                                                                PID:9648
                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                              6⤵
                                                                PID:11620
                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                6⤵
                                                                  PID:16128
                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                5⤵
                                                                  PID:3716
                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                    6⤵
                                                                      PID:6484
                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                        7⤵
                                                                          PID:12044
                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                          7⤵
                                                                            PID:16356
                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                          6⤵
                                                                            PID:7536
                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                              7⤵
                                                                                PID:15692
                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                7⤵
                                                                                  PID:9920
                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                6⤵
                                                                                  PID:9176
                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                    7⤵
                                                                                      PID:15700
                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                      7⤵
                                                                                        PID:10128
                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                      6⤵
                                                                                        PID:11604
                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                        6⤵
                                                                                          PID:15976
                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                        5⤵
                                                                                          PID:5176
                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                            6⤵
                                                                                              PID:9604
                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                7⤵
                                                                                                  PID:21708
                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                6⤵
                                                                                                  PID:11612
                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                  6⤵
                                                                                                    PID:16024
                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                  5⤵
                                                                                                    PID:6744
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                      6⤵
                                                                                                        PID:11700
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                        6⤵
                                                                                                          PID:16444
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                        5⤵
                                                                                                          PID:9228
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                            6⤵
                                                                                                              PID:15284
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                              6⤵
                                                                                                                PID:10100
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                              5⤵
                                                                                                                PID:11892
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                5⤵
                                                                                                                  PID:16236
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                4⤵
                                                                                                                • Checks computer location settings
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:1504
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                  5⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:3984
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                    6⤵
                                                                                                                      PID:5960
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                        7⤵
                                                                                                                          PID:9624
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                            8⤵
                                                                                                                              PID:15144
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                              8⤵
                                                                                                                                PID:7548
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                              7⤵
                                                                                                                                PID:11580
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                7⤵
                                                                                                                                  PID:15820
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                  7⤵
                                                                                                                                    PID:13708
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                  6⤵
                                                                                                                                    PID:6728
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                      7⤵
                                                                                                                                        PID:12084
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                        7⤵
                                                                                                                                          PID:16252
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                        6⤵
                                                                                                                                          PID:9140
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                            7⤵
                                                                                                                                              PID:15088
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                              7⤵
                                                                                                                                                PID:5036
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                              6⤵
                                                                                                                                                PID:11900
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                6⤵
                                                                                                                                                  PID:16468
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                5⤵
                                                                                                                                                  PID:5144
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                    6⤵
                                                                                                                                                      PID:11764
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                      6⤵
                                                                                                                                                        PID:16032
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                      5⤵
                                                                                                                                                        PID:6836
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                          6⤵
                                                                                                                                                            PID:11844
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                            6⤵
                                                                                                                                                              PID:16080
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                              6⤵
                                                                                                                                                                PID:23080
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                              5⤵
                                                                                                                                                                PID:7176
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:1576
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:9536
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:12140
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:16508
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:1108
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:6136
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:10056
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:22024
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:11556
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:16120
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:6600
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:11940
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:16592
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:9384
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:15684
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:10072
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:12188
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:16380
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:5208
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:10180
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:15080
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:20492
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:11548
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:15796
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:13892
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:6608
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:11956
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:16412
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:8296
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:15096
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:22492
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:11980
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:16600
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                              PID:1592
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                PID:3644
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:4748
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:6224
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                            PID:12028
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                              PID:16500
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                PID:5044
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:6648
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                    PID:11868
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                      PID:16564
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:9360
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                          PID:15600
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                            PID:8408
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:11636
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:16064
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                              PID:5128
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:7064
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                      PID:12052
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                        PID:16292
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:9184
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                            PID:15112
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                              PID:22500
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:12116
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:16276
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:6548
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:11828
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:16228
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:7748
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                          PID:15344
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:9992
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                            PID:9160
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                PID:15708
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                  PID:9796
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:11452
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                    PID:16268
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:1756
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                      PID:6056
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                          PID:11724
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                            PID:16136
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                            PID:6696
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                PID:12036
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                  PID:16404
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:9324
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                      PID:15180
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                        PID:9684
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                        PID:12164
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                          PID:16284
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:5160
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                              PID:8212
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                  PID:15188
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                    PID:10044
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                    PID:11924
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                      PID:16300
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:6760
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                          PID:12012
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                            PID:16524
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                            PID:9260
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                PID:15608
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                  PID:9496
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:11884
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                    PID:16244
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                  PID:860
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2524
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6204
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                              PID:9480
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3560
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:9488
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:11596
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:15968
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:18748
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6664
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:11996
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:18704
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:9352
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:15328
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:9680
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:11476
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:15716
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:13704
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5152
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:11972
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:16364
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6768
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:11860
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:16492
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:9220
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:15576
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:8380
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:11524
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:15756
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:13872
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6252
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12060
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:16372
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6640
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12020
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:16516
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9368
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:15616
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9392
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12180
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:16220
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10048
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:21268
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11668
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:16540
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6616
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10612
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11540
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:15984
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9244
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:15320
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10008
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11836
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:16048
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1720
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:16072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:16308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:15304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:16436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:16348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:16556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:15580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:15128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:22508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:18664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:16452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:16476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:15668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:16040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:18656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:21972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:15788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:18752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:18640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:16648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:15336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:15724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:16144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:16580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:18688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:16428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:18672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:15104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:22516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:15780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:16088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:21136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:15740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:15352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:18696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:15772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:16104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:15652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:16572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:16016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:15120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:15748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:15956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:18360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:16532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:15624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:15764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:16260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:16420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:15592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:21016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:16388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:21276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:15952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:22752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:16460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:15012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:22476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:15812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:18756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:15312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:16484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:16008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:15072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:16548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:16324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:15676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:18648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:16396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:16000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:16096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:15036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:22468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:15732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:16056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:16332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:15136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\66c839f8be70f51d4ee5b72d73f4440e_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:16340

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              french porn masturbation circumcision .rar.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\french porn masturbation circumcision .rar.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 710KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 4969b0e1538298a9c7191d8939593815177d782f6b4f63ce5fc576c07fac702a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download