xtremerat | aa44cd3db152fa38c70321433628cb306f956e8b15d808c9622c1abd843e9453

Analysis

max time kernel
149s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Size

21KB
MD5

984857a166b08c993fd30d7cc3bc1b6a
SHA1

40929c549ba105263f6699a912fa9c469cf22b27
SHA256

aa44cd3db152fa38c70321433628cb306f956e8b15d808c9622c1abd843e9453
SHA512

87788794fb00cdfd40709b25b6f8c9769524534c9889853946b718de9beb9c840539e478b62f5a3408b5676ee59447d634d183f5bd36d2ccba5c9d1a1d678969
SSDEEP

384:cIdmF+Ti213fEF9QZd/cBr5M/gOjkaS4s/1k5YiZNl2KQhb/ulaqjpLR:cIsF81fG9QveLOYTe5YikKEGljr

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 38 IoCs

resource	yara_rule
behavioral1/memory/2372-3-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2372-4-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2372-6-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1972-10-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2956-16-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2684-20-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/576-25-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1240-30-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1148-33-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2612-36-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1476-40-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/608-44-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/608-47-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1540-49-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/884-54-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1480-53-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/884-60-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2328-65-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1560-68-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1640-72-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1400-75-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/944-79-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2172-82-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/828-86-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2872-89-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2176-94-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1640-93-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2176-97-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2872-100-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1052-101-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2872-103-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1052-105-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/3240-109-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/3128-108-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/3240-112-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/3352-117-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/3476-120-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/3592-124-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2372-0-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2372-3-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2372-4-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2372-6-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2956-11-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1972-10-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2684-17-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2956-16-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2684-20-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/576-21-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/576-25-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1240-30-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1148-33-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1476-37-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2612-36-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1476-40-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/608-44-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/608-47-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1540-49-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/884-54-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1480-53-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/884-60-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2328-65-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1560-68-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1640-72-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1400-75-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/944-79-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2172-82-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/828-86-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2872-89-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2176-94-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1640-93-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2176-97-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2872-100-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1052-101-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2872-103-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1052-105-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/3240-109-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/3128-108-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/3240-112-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/3352-117-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/3476-120-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/3592-124-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2100	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2100	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2100	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2100	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2100	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2112	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2112	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2112	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2112	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2112	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2060	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2060	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2060	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2060	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2060	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2476	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2476	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2476	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2476	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2476	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2468	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	35
PID 2372 wrote to memory of 2468	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	35
PID 2372 wrote to memory of 2468	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	35
PID 2372 wrote to memory of 2468	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	35
PID 2372 wrote to memory of 2468	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	35
PID 2372 wrote to memory of 844	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	36
PID 2372 wrote to memory of 844	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	36
PID 2372 wrote to memory of 844	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	36
PID 2372 wrote to memory of 844	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	36
PID 2372 wrote to memory of 844	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	36
PID 2372 wrote to memory of 2492	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	37
PID 2372 wrote to memory of 2492	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	37
PID 2372 wrote to memory of 2492	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	37
PID 2372 wrote to memory of 2492	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	37
PID 2372 wrote to memory of 2492	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	37
PID 2372 wrote to memory of 2504	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	38
PID 2372 wrote to memory of 2504	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	38
PID 2372 wrote to memory of 2504	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	38
PID 2372 wrote to memory of 2504	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	38
PID 2372 wrote to memory of 1972	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	39
PID 2372 wrote to memory of 1972	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	39
PID 2372 wrote to memory of 1972	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	39
PID 2372 wrote to memory of 1972	2372	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	39
PID 1972 wrote to memory of 2232	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	40
PID 1972 wrote to memory of 2232	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	40
PID 1972 wrote to memory of 2232	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	40
PID 1972 wrote to memory of 2232	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	40
PID 1972 wrote to memory of 2232	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	40
PID 1972 wrote to memory of 2304	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	41
PID 1972 wrote to memory of 2304	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	41
PID 1972 wrote to memory of 2304	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	41
PID 1972 wrote to memory of 2304	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	41
PID 1972 wrote to memory of 2304	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	41
PID 1972 wrote to memory of 2676	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	42
PID 1972 wrote to memory of 2676	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	42
PID 1972 wrote to memory of 2676	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	42
PID 1972 wrote to memory of 2676	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	42
PID 1972 wrote to memory of 2676	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	42
PID 1972 wrote to memory of 2764	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	43
PID 1972 wrote to memory of 2764	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	43
PID 1972 wrote to memory of 2764	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	43
PID 1972 wrote to memory of 2764	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	43
PID 1972 wrote to memory of 2764	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	43
PID 1972 wrote to memory of 2780	1972	984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe	44

C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2100
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2112
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2060
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2476
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2468
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:844
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2492
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2504
- C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2232
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2304
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2676
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2764
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2780
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2800
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2820
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2768
- - C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2956
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2732
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2608
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2836
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2840
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2660
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2792
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2348
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2684
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2568
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2588
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2636
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2644
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2740
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2164
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:3056
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:576
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2116
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1732
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1720
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1992
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1988
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2040
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2316
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1240
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1236
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:236
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:624
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:112
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1816
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:336
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1680
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1148
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1800
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1996
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2672
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2896
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2880
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2632
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2612
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2668
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2208
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1600
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2760
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2144
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:796
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1476
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1080
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1152
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1504
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1664
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2180
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2160
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:688
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:608
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1168
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2296
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1748
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2428
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:764
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2440
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1728
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1540
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1768
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2156
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1360
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2376
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:1480
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2188
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2448
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2264
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:756
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2524
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:872
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:952
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:884
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:1564
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:1596
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:1700
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:1584
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2280
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2472
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:1932
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2168
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2292
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:1972
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2580
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:1560
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:2848
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:1708
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:2736
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:2692
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:2832
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:2288
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:2356
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2096
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1712
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1688
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2324
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:396
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1516
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1404
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:1400
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:2224
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:3036
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:3024
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:2392
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:444
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:2876
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:1852
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:944
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1356
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:608
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2552
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1032
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2908
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:848
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:2172
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:788
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:2400
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:1796
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:2260
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:1268
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:584
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:2340
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:828
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2192
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:884
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2108
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2652
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:932
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:920
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2996
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:2872
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:2576
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:2308
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:2600
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:2044
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:1652
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:2680
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:1780
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2444
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1340
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1860
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1528
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:908
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2336
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:2176
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:2948
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:2172
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:2052
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:1496
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:2416
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:2756
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:1276
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:2872
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:3028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:3032
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1272
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1896
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2140
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1968
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2396
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:1052
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:1400
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:2872
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:2088
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:1148
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:3080
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:3092
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:3100
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        26⤵
        System Location Discovery: System Language Discovery
        
        PID:3128
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:3160
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:3168
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:3180
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:3188
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:3200
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:3208
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:3220
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:3240
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        28⤵
        
        PID:3268
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        28⤵
        
        PID:3280
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        28⤵
        
        PID:3292
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        28⤵
        
        PID:3300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        28⤵
        
        PID:3312
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        28⤵
        
        PID:3320
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        28⤵
        
        PID:3332
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        28⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        28⤵
        System Location Discovery: System Language Discovery
        
        PID:3352
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:3392
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:3404
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:3412
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:3424
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:3432
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:3444
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:3452
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        30⤵
        
        PID:3500
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        30⤵
        
        PID:3516
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        30⤵
        
        PID:3528
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        30⤵
        
        PID:3540
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        30⤵
        
        PID:3548
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        30⤵
        
        PID:3560
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        30⤵
        
        PID:3568
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        30⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        30⤵
        System Location Discovery: System Language Discovery
        
        PID:3592
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:3624
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:3632
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:3644
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:3652
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:3664
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:3672
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:3684
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\984857a166b08c993fd30d7cc3bc1b6a_JaffaCakes118.exe"
        31⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        32⤵
        
        PID:3732
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        32⤵
        
        PID:3744
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        32⤵
        
        PID:3756
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        32⤵
        
        PID:3764
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        32⤵
        
        PID:3776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
a105d3b0b6cd099fadbff4889722192e

SHA1
6a2786424fbb1b91c776dfd2963557d5da8536db

SHA256
f6f09616d6efbe383a37c13dd37ac67bb3f460dbe1f01c60f9e745d1c8ff429b

SHA512
b50c32b602297ff203c22238dd1303046d65eb5d945312f95ea0935ca228d28db7cbeed74a7e9293b86a7544908482ee803740e86ed713d2ebd8680662e1e0a9

Download Submit
memory/576-21-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/576-25-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/608-44-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/608-47-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/828-86-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/884-60-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/884-54-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/944-79-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1052-105-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1052-101-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1148-33-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1240-30-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1400-75-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1476-46-0x0000000002A00000-0x0000000002A16000-memory.dmp

Filesize
88KB

Download
memory/1476-37-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1476-40-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1476-41-0x0000000002A00000-0x0000000002A16000-memory.dmp

Filesize
88KB

Download
memory/1480-53-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1540-58-0x0000000002A00000-0x0000000002A16000-memory.dmp

Filesize
88KB

Download
memory/1540-49-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1560-68-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1640-93-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1640-72-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1972-10-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2172-82-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2176-94-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2176-97-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2328-65-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2372-0-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2372-3-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2372-4-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2372-6-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2612-36-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2684-17-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2684-20-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2872-100-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2872-89-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2872-103-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2956-16-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2956-11-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3128-108-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3240-109-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3240-112-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3240-113-0x0000000002A00000-0x0000000002A16000-memory.dmp

Filesize
88KB

Download
memory/3352-117-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3476-120-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3592-124-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download