darktrack | 143ca382177b6c4589e841d40b278271be045551ad8a33f24b169106ceac70d8

Analysis

max time kernel
74s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Size 700KB
Sample240329-k638caef23
SHA256 143ca382177b6c4589e841d40b278271be045551ad8a33f24b169106ceac70d8
MD5 1e3777710e6fc8f141ce09c97f61a127
SHA1 4437c9f32fe48c86382b784c3fd1bac86482378e
SHA512 4c8e5a0673dc3ac812cec91147d30fbc2b44a0da5e68fa9df513554f7a238190296bb16fd83db7daf2d30c8f4b147bbfffc3028ef3316b1ddf1a35541ffbc422
SSDEEP 12288:mD8edYIV/jVbOzS7JIHRuzLu7sCeQvLTG1XEn+8sNQIAD5qpffAIusjc6R:68edF/pEgJFOJG10fs1N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darktrack persistence rat stealer

Malware Config

Signatures

DarkTrack
DarkTrack is a remote administration tool written in delphi.
rat stealer darktrack

DarkTrack payload 44 IoCs

resource	yara_rule
behavioral2/memory/2060-6-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/2060-8-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/2060-10-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/2060-11-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/2060-12-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/2060-25-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4944-36-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4944-42-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4944-44-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4944-46-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4264-47-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4264-49-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4264-50-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4944-35-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4944-33-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/2444-56-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/2444-58-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/2444-59-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/2064-65-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/2064-66-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/2064-70-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/1116-76-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/1116-74-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/1116-77-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4892-84-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4892-85-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4892-86-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4988-94-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4988-93-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4988-95-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/488-102-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/488-103-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/488-104-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4344-112-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4344-113-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/1032-120-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/1032-121-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/1032-123-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4328-129-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4328-133-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4528-138-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/4528-142-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/2784-148-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/2784-152-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
1648	DtServ32.exe
4944	DtServ32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DtServ32sm.exe = "C:\\Users\\Admin\\AppData\\Roaming\\DtServ32.exe"	notepad.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 2060	2372	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	94
PID 1648 set thread context of 4944	1648	DtServ32.exe	100
PID 3584 set thread context of 4264	3584	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	104
PID 812 set thread context of 2444	812	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	106
PID 3368 set thread context of 2064	3368	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	163
PID 3628 set thread context of 1116	3628	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	112
PID 4568 set thread context of 4892	4568	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	118
PID 3908 set thread context of 4988	3908	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	120
PID 1560 set thread context of 488	1560	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	137
PID 3196 set thread context of 4344	3196	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	125
PID 4404 set thread context of 1032	4404	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	188
PID 1612 set thread context of 4328	1612	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	184
PID 5096 set thread context of 4528	5096	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	134
PID 3812 set thread context of 2784	3812	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	178
PID 488 set thread context of 4984	488	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	138
PID 4836 set thread context of 3560	4836	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	191
PID 820 set thread context of 3796	820	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	142
PID 4572 set thread context of 3292	4572	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	144
PID 264 set thread context of 3780	264	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	146
PID 2352 set thread context of 1060	2352	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	239
PID 3216 set thread context of 3560	3216	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	191
PID 3700 set thread context of 4596	3700	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	154
PID 4520 set thread context of 3160	4520	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	156
PID 3040 set thread context of 3596	3040	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	170
PID 3232 set thread context of 4392	3232	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	189
PID 5056 set thread context of 2064	5056	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	163
PID 2668 set thread context of 884	2668	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	298
PID 1940 set thread context of 5044	1940	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	193
PID 1936 set thread context of 560	1936	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	216
PID 3596 set thread context of 4168	3596	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	181
PID 3228 set thread context of 3028	3228	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	173
PID 5108 set thread context of 4372	5108	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	175
PID 4764 set thread context of 1188	4764	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	177
PID 2784 set thread context of 5008	2784	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	179
PID 4888 set thread context of 4168	4888	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	181
PID 3632 set thread context of 4328	3632	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	301
PID 4636 set thread context of 2856	4636	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	258
PID 4852 set thread context of 1032	4852	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	295
PID 4392 set thread context of 4092	4392	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	190
PID 3560 set thread context of 4228	3560	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	200
PID 5044 set thread context of 4268	5044	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	228
PID 4680 set thread context of 1460	4680	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	252
PID 1120 set thread context of 920	1120	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	199
PID 4228 set thread context of 116	4228	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	215
PID 780 set thread context of 1600	780	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	414
PID 2452 set thread context of 3904	2452	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	333
PID 2180 set thread context of 4268	2180	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	228
PID 3736 set thread context of 2568	3736	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	268
PID 2024 set thread context of 3428	2024	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	224
PID 2724 set thread context of 116	2724	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	215
PID 560 set thread context of 4268	560	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	228
PID 3016 set thread context of 2120	3016	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	223
PID 3428 set thread context of 4908	3428	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	332
PID 2104 set thread context of 4844	2104	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	307
PID 4268 set thread context of 3512	4268	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	229
PID 3608 set thread context of 2596	3608	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	231
PID 2808 set thread context of 4276	2808	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	313
PID 1980 set thread context of 5060	1980	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	266
PID 1068 set thread context of 884	1068	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	298
PID 4396 set thread context of 1060	4396	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	239
PID 4604 set thread context of 4460	4604	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	288
PID 4728 set thread context of 4892	4728	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	244
PID 948 set thread context of 884	948	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	298
PID 4992 set thread context of 3372	4992	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	265

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3584	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3584	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4568	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4568	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4568	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4568	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
5096	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
5096	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3216	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3216	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3216	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3216	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3040	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3040	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3632	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3632	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2180	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2180	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2024	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2024	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
560	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
560	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3016	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3016	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3016	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3016	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3016	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3016	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4604	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4604	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4992	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4992	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4992	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4992	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4864	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4864	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4864	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4864	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4864	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4864	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1816	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1816	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2108	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2108	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4408	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
4408	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3684	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3684	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3684	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3684	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3684	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3684	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1076	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1076	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1596	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1596	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1712	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1712	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3276	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3276	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
5140	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
5140	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4944	DtServ32.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	3584	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	4568	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5096	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	3216	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	3040	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	3632	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2180	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2024	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	560	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	3016	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	4604	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	4992	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	4864	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1816	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2108	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	4408	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	3684	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1076	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	3060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1596	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1712	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	3276	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5140	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5452	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5880	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5264	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5652	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5720	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	6056	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5316	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5420	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5744	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5724	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5708	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5872	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5260	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5472	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	3200	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	3520	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	4720	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5676	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5792	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5920	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	5604	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2060	2372	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	94
PID 2372 wrote to memory of 2060	2372	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	94
PID 2372 wrote to memory of 2060	2372	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	94
PID 2372 wrote to memory of 2060	2372	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	94
PID 2372 wrote to memory of 2060	2372	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	94
PID 2372 wrote to memory of 2060	2372	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	94
PID 2372 wrote to memory of 2060	2372	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	94
PID 2372 wrote to memory of 2060	2372	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	94
PID 2372 wrote to memory of 2060	2372	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	94
PID 2372 wrote to memory of 2060	2372	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	94
PID 2372 wrote to memory of 2060	2372	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	94
PID 2372 wrote to memory of 2060	2372	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	94
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 3788	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2060 wrote to memory of 2920	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	96
PID 2060 wrote to memory of 2920	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	96
PID 2060 wrote to memory of 2920	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	96
PID 2060 wrote to memory of 1648	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	98
PID 2060 wrote to memory of 1648	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	98
PID 2060 wrote to memory of 1648	2060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	98
PID 3788 wrote to memory of 3584	3788	notepad.exe	99
PID 3788 wrote to memory of 3584	3788	notepad.exe	99
PID 3788 wrote to memory of 3584	3788	notepad.exe	99
PID 1648 wrote to memory of 4944	1648	DtServ32.exe	100
PID 1648 wrote to memory of 4944	1648	DtServ32.exe	100
PID 1648 wrote to memory of 4944	1648	DtServ32.exe	100
PID 1648 wrote to memory of 4944	1648	DtServ32.exe	100
PID 1648 wrote to memory of 4944	1648	DtServ32.exe	100
PID 1648 wrote to memory of 4944	1648	DtServ32.exe	100
PID 1648 wrote to memory of 4944	1648	DtServ32.exe	100
PID 1648 wrote to memory of 4944	1648	DtServ32.exe	100
PID 1648 wrote to memory of 4944	1648	DtServ32.exe	100
PID 1648 wrote to memory of 4944	1648	DtServ32.exe	100
PID 1648 wrote to memory of 4944	1648	DtServ32.exe	100
PID 1648 wrote to memory of 4944	1648	DtServ32.exe	100
PID 3584 wrote to memory of 216	3584	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	101
PID 3584 wrote to memory of 216	3584	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	101
PID 3584 wrote to memory of 216	3584	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	101
PID 4944 wrote to memory of 1636	4944	DtServ32.exe	102
PID 4944 wrote to memory of 1636	4944	DtServ32.exe	102
PID 4944 wrote to memory of 1636	4944	DtServ32.exe	102
PID 4944 wrote to memory of 1636	4944	DtServ32.exe	102
PID 4944 wrote to memory of 1636	4944	DtServ32.exe	102
PID 4944 wrote to memory of 1636	4944	DtServ32.exe	102

C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:216
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:812
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:488
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:488
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:820
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:264
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:560
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:884
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:560
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:920
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:116
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:780
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:116
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:560
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:884
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:948
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:884
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:456
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:884
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:776
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:412
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:432
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:412
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:884
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:432
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:364
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:652
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:760
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:432
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:728
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:960
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:464
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6952
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6656
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6552
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:908
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:556
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:784
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:6924
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1E3777~1.EXE >> NUL
    3⤵
    PID:2920
- - C:\Users\Admin\AppData\Roaming\DtServ32.exe
    "C:\Users\Admin\AppData\Roaming\DtServ32.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Users\Admin\AppData\Roaming\DtServ32.exe
      "C:\Users\Admin\AppData\Roaming\DtServ32.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:1636
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        Adds Run key to start application
        
        PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=3112,i,1786399861560734457,5606877702857066305,262144 --variations-seed-version /prefetch:8
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe.log
Size 410B
SHA256 93b740416114e346878801c73e8a8670ff1390d3fa009424b88fafe614a3c5cd
MD5 24cfd42a8de70b38ed70e1f8cf4eda1c
SHA1 e447168fd38da9175084b36a06c3e9bbde99064c
SHA512 5c2daf5328ba99d750e9d0362e84f3a79b7fc8395aa8aa2bc1a01b266583fe1f8352bf0619f985aa72223412d14afa054537739b4941610a1d0f96e7fee2a875
MD5 SHA1 SHA512

Submit Download

DtServ32.exe

Path C:\Users\Admin\AppData\Roaming\DtServ32.exe
Size 700KB
SHA256 143ca382177b6c4589e841d40b278271be045551ad8a33f24b169106ceac70d8
MD5 1e3777710e6fc8f141ce09c97f61a127
SHA1 4437c9f32fe48c86382b784c3fd1bac86482378e
SHA512 4c8e5a0673dc3ac812cec91147d30fbc2b44a0da5e68fa9df513554f7a238190296bb16fd83db7daf2d30c8f4b147bbfffc3028ef3316b1ddf1a35541ffbc422
SSDEEP 12288:mD8edYIV/jVbOzS7JIHRuzLu7sCeQvLTG1XEn+8sNQIAD5qpffAIusjc6R:68edF/pEgJFOJG10fs1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/488-153-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/488-102-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/488-103-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/488-154-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

Download

memory/488-104-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/812-52-0x0000000004E20000-0x0000000004E30000-memory.dmp

Download

memory/812-51-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/812-57-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/1032-121-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1032-123-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1032-120-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1116-77-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1116-76-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1116-74-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1560-97-0x0000000000E50000-0x0000000000E60000-memory.dmp

Download

memory/1560-101-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/1560-96-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/1612-122-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/1612-128-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/1612-124-0x0000000004B30000-0x0000000004B40000-memory.dmp

Download

memory/1648-37-0x0000000072C30000-0x00000000733E0000-memory.dmp

Download

memory/1648-27-0x0000000005870000-0x0000000005880000-memory.dmp

Download

memory/1648-26-0x0000000072C30000-0x00000000733E0000-memory.dmp

Download

memory/2060-25-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2060-11-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2060-10-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2060-12-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2060-8-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2060-6-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2064-66-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2064-70-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2064-65-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2372-4-0x0000000004E20000-0x0000000004EB2000-memory.dmp

Download

memory/2372-1-0x0000000000350000-0x0000000000404000-memory.dmp

Download

memory/2372-3-0x0000000005330000-0x00000000058D4000-memory.dmp

Download

memory/2372-5-0x0000000004D60000-0x0000000004D6A000-memory.dmp

Download

memory/2372-2-0x0000000004D70000-0x0000000004D80000-memory.dmp

Download

memory/2372-0-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/2372-9-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/2444-56-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2444-59-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2444-58-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2784-148-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2784-152-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2792-39-0x0000000000530000-0x0000000000531000-memory.dmp

Download

memory/3196-110-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/3196-105-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/3196-106-0x0000000002970000-0x0000000002980000-memory.dmp

Download

memory/3368-60-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/3368-61-0x00000000057A0000-0x00000000057B0000-memory.dmp

Download

memory/3368-67-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/3584-48-0x0000000072C30000-0x00000000733E0000-memory.dmp

Download

memory/3584-34-0x0000000072C30000-0x00000000733E0000-memory.dmp

Download

memory/3628-75-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/3628-69-0x0000000005910000-0x0000000005920000-memory.dmp

Download

memory/3628-68-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/3788-13-0x00000000007E0000-0x00000000007E1000-memory.dmp

Download

memory/3812-143-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/3812-144-0x00000000050E0000-0x00000000050F0000-memory.dmp

Download

memory/3812-150-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/3908-88-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Download

memory/3908-92-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/3908-87-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/4264-49-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4264-50-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4264-47-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4328-129-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4328-133-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4344-112-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4344-113-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4404-114-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/4404-115-0x00000000054F0000-0x0000000005500000-memory.dmp

Download

memory/4404-119-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/4528-142-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4528-138-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4568-78-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/4568-79-0x0000000005750000-0x0000000005760000-memory.dmp

Download

memory/4568-83-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/4892-85-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4892-86-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4892-84-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4944-44-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4944-33-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4944-36-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4944-42-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4944-35-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4944-46-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4988-93-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4988-95-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4988-94-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5096-139-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download

memory/5096-134-0x0000000005A20000-0x0000000005A30000-memory.dmp

Download

memory/5096-131-0x0000000072EB0000-0x0000000073660000-memory.dmp

Download