14dc6c810d05eb1495553e3b8ae5957295ba74ff05c33f01953f60045f78fa87

Analysis

max time kernel
94s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
Size

278KB
MD5

9e48e6f06510660156ad80342a8b06a4
SHA1

b8ffe03975a171c4cf231a2e714e75e1ac9e061d
SHA256

14dc6c810d05eb1495553e3b8ae5957295ba74ff05c33f01953f60045f78fa87
SHA512

c3522957117e157f8c5edc142ae5b4eebe9d25c6c8490d1564b6f12b20be026600bb17bb3407d20ebcb546a7ce65ceef97714ce1d9bc3fbc79c65e8cda349b0e
SSDEEP

6144:ZplxR++UT/dwsoMi1TQ+yBuFzQgqj2NHez2TfUXJ/8DCcqWiKY1:ZjxR9UTV5i1U+yOsgqj2lC2I18DfqWda

Score

9^/10

collection discovery

Malware Config

Signatures

Detected Nirsoft tools 15 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral2/memory/2596-9-0x0000000000400000-0x000000000041E000-memory.dmp	Nirsoft
behavioral2/memory/2596-11-0x0000000000400000-0x000000000041E000-memory.dmp	Nirsoft
behavioral2/memory/2596-12-0x0000000000400000-0x000000000041E000-memory.dmp	Nirsoft
behavioral2/memory/4468-27-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral2/memory/4468-29-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral2/memory/4468-30-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral2/memory/1028-35-0x0000000000400000-0x000000000041A000-memory.dmp	Nirsoft
behavioral2/memory/1028-37-0x0000000000400000-0x000000000041A000-memory.dmp	Nirsoft
behavioral2/memory/1028-38-0x0000000000400000-0x000000000041A000-memory.dmp	Nirsoft
behavioral2/memory/1812-55-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/1812-57-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/1812-58-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/1148-64-0x0000000000400000-0x0000000000410000-memory.dmp	Nirsoft
behavioral2/memory/1148-66-0x0000000000400000-0x0000000000410000-memory.dmp	Nirsoft
behavioral2/memory/1148-65-0x0000000000400000-0x0000000000410000-memory.dmp	Nirsoft

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/1028-35-0x0000000000400000-0x000000000041A000-memory.dmp	MailPassView
behavioral2/memory/1028-37-0x0000000000400000-0x000000000041A000-memory.dmp	MailPassView
behavioral2/memory/1028-38-0x0000000000400000-0x000000000041A000-memory.dmp	MailPassView

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe

description	pid	process	target process
PID 3956 set thread context of 2596	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 set thread context of 2244	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 set thread context of 4468	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 set thread context of 1028	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 set thread context of 4832	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 set thread context of 1812	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 set thread context of 1148	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe

pid process

2596 9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
2596 9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe

pid	process
2596	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
2596	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2596	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
Token: SeDebugPrivilege	4468	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Users\Admin\AppData\Local\Temp\9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2244
- C:\Users\Admin\AppData\Local\Temp\9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- C:\Users\Admin\AppData\Local\Temp\9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  - Accesses Microsoft Outlook accounts
  - System Location Discovery: System Language Discovery
  PID:1028
- C:\Users\Admin\AppData\Local\Temp\9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4832
- C:\Users\Admin\AppData\Local\Temp\9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1812
- C:\Users\Admin\AppData\Local\Temp\9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp.txt

Filesize
33B

MD5
fec8656dbc9772ee24163ae3d57f41d9

SHA1
4e82071ada9bdc0002decba8b18b22a6dfdd127d

SHA256
7a3295b2c8c4797b8e5b4616bcc19bca30266371a54666855cbc67d443a3e4f4

SHA512
7c5965e41515a34db05c442587607bb51b6a3a8662df39513474f0d12c1236d882989d8c8bc99d24be27531c0e0df76af8c4beaf45e041767ab6ba2c72fc9326

Download Submit
memory/1028-35-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1028-34-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1028-32-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1028-33-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1028-37-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1028-38-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1148-61-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1148-60-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1148-62-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1148-64-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1148-66-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1148-65-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1812-52-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1812-55-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1812-58-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1812-57-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1812-53-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1812-54-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2244-21-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2244-22-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2244-16-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2244-20-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2244-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2244-15-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2244-17-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2596-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2596-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2596-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2596-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2596-12-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2596-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3956-0-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/4468-27-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4468-30-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4468-25-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4468-26-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4468-29-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4468-24-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4832-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4832-46-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4832-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4832-41-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4832-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4832-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

description	pid	process	target process
PID 3956 wrote to memory of 2596	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2596	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2596	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2596	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2596	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2596	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2596	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2596	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2596	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2244	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2244	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2244	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2244	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2244	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2244	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2244	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2244	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 2244	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4468	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4468	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4468	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4468	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4468	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4468	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4468	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4468	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4468	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1028	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1028	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1028	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1028	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1028	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1028	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1028	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1028	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1028	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4832	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4832	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4832	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4832	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4832	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4832	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4832	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4832	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 4832	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1812	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1812	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1812	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1812	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1812	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1812	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1812	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1812	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1812	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1148	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1148	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1148	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1148	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1148	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1148	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1148	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1148	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe
PID 3956 wrote to memory of 1148	3956	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe	9e48e6f06510660156ad80342a8b06a4_JaffaCakes118.exe