Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2024, 05:01

General

  • Target

    118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    118f059821b8d4975ffdd1c7b408a0d1

  • SHA1

    b092241b439a2df7b0be6e6d645bbb1c377bdbf6

  • SHA256

    8323e166ea4ff29525b602184d50dae8f5a066c9138814f998cbbf2ef83b035d

  • SHA512

    6e758c0565fce01da897eff280293cf53533e190ddf4441d64ad31fa5686f8e4d39eebe85e21edf4c23e650174957bce2e101e411947eeba8ce84e1e8e3773ad

  • SSDEEP

    24576:/R/QWtd8hGIxNU/j/1e6RrmlcXaP12yZSrsnSWjlmcf8uOqTH4gVlrI:/RoW/8FG11nXk1XSAfFOqTH4gXI

Score
3/10

Malware Config

Signatures

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
      2⤵
        PID:1472
      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
        2⤵
          PID:2528
        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
          2⤵
            PID:936
          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
            2⤵
              PID:768
            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
              2⤵
                PID:748
              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                2⤵
                  PID:2728
                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                  2⤵
                    PID:1136
                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                    2⤵
                      PID:3684
                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                      2⤵
                        PID:2744
                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                        2⤵
                          PID:4504
                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                          2⤵
                            PID:4916
                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                            2⤵
                              PID:388
                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                              2⤵
                                PID:1220
                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                2⤵
                                  PID:4904
                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                  2⤵
                                    PID:2180
                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                    2⤵
                                      PID:4416
                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                      2⤵
                                        PID:1956
                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                        2⤵
                                          PID:1756
                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                          2⤵
                                            PID:5076
                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                            2⤵
                                              PID:1096
                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                              2⤵
                                                PID:880
                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                2⤵
                                                  PID:2148
                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                  2⤵
                                                    PID:4316
                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                    2⤵
                                                      PID:4936
                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                      2⤵
                                                        PID:3136
                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                        2⤵
                                                          PID:3328
                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                          2⤵
                                                            PID:2564
                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                            2⤵
                                                              PID:1632
                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                              2⤵
                                                                PID:3268
                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                2⤵
                                                                  PID:2016
                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                  2⤵
                                                                    PID:1860
                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                    2⤵
                                                                      PID:4892
                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                      2⤵
                                                                        PID:4508
                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                        2⤵
                                                                          PID:4500
                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                          2⤵
                                                                            PID:5088
                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                            2⤵
                                                                              PID:1520
                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                              2⤵
                                                                                PID:2144
                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                2⤵
                                                                                  PID:3600
                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                  2⤵
                                                                                    PID:3676
                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                    2⤵
                                                                                      PID:1708
                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                      2⤵
                                                                                        PID:4332
                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                        2⤵
                                                                                          PID:2696
                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                          2⤵
                                                                                            PID:2916
                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                            2⤵
                                                                                              PID:4656
                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                              2⤵
                                                                                                PID:3656
                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                2⤵
                                                                                                  PID:5032
                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                  2⤵
                                                                                                    PID:3408
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                    2⤵
                                                                                                      PID:3560
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                      2⤵
                                                                                                        PID:1596
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                        2⤵
                                                                                                          PID:4084
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                          2⤵
                                                                                                            PID:4464
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                            2⤵
                                                                                                              PID:3192
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                              2⤵
                                                                                                                PID:376
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                2⤵
                                                                                                                  PID:4552
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                  2⤵
                                                                                                                    PID:844
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                    2⤵
                                                                                                                      PID:4496
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                      2⤵
                                                                                                                        PID:1324
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                        2⤵
                                                                                                                          PID:2168
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                          2⤵
                                                                                                                            PID:3620
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                            2⤵
                                                                                                                              PID:2804
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                              2⤵
                                                                                                                                PID:4944
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                2⤵
                                                                                                                                  PID:5020
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                  2⤵
                                                                                                                                    PID:4964
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                    2⤵
                                                                                                                                      PID:4324
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                      2⤵
                                                                                                                                        PID:2072
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                        2⤵
                                                                                                                                          PID:5100
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                          2⤵
                                                                                                                                            PID:1416
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                            2⤵
                                                                                                                                              PID:3496
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                              2⤵
                                                                                                                                                PID:4876
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:4976
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2364
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2988
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2192
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1628
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1424
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3032
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2336
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1120
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1276
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3580
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4336
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2448
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:904
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:4016
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:4264
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:3872
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1996
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4412
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:4228
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3180
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:4268
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:2112
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:4536
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1616
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:808
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:2724
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:3264
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:2132
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2240
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:3624
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1892
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1400
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:3476
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:4984
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:4176
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1280
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:540
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:4064
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1712
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:2468
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:4528
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:4700
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:3996
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:3696
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:4092
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:3236
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:2004
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1660
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:2432
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:4188
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:512
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:1832
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:3468
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:5092
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:2816
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:668
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:3376
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:5116
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:1008
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:532
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:4540
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:4520
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:1588
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:4888
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:2408
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:2672
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:3976
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:664
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:1592
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:2492
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:3080
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:3400
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:4072
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:3596
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:2176
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:3464
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:4524
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:4448
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:3184
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:4452
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:2436
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:1360
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:4512
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:1752
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:4244
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:3612
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:1512
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:804
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:2368
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:3272
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:412
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:368
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:2424
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:4484
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:2732
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1620
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2512
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2280
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:432
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2688
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2476
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1952
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4168
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1356
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4036
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2892
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4992
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4756
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3644
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1104
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4576
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2908
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3132
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4120
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4724
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4676
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4920
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1576
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2184
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1108
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:600
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 240
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 248
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1760 -ip 1760
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5180
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1760 -ip 1760
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5504

                                                                                                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Matrix

                                                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1760-0-0x00000000003C0000-0x00000000003C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                        20KB