Analysis
-
max time kernel
36s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 11:13
Static task
static1
Behavioral task
behavioral1
Sample
3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe
Resource
win10v2004-20240708-en
General
-
Target
3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe
-
Size
325KB
-
MD5
3022e32456f79f6b5c98eee161cc2c59
-
SHA1
ee85b6530b854cece2925c45a3d07d0ea2260785
-
SHA256
e643bcc73f7deaeaaa41824d5dcabdfe19260f83f0fc88c98f811244c1e898a8
-
SHA512
12373cfbbe469585702d103547e696e11dad7338fbb1a49b0a6255d501db5e3a8c4d09ad541f79135fdd6d2b6100f05172ca2b5e8b64c1dfb74886ceb56affa0
-
SSDEEP
6144:JN5wsFrCkm2IkzJxDRNtgW/q7FDY8fOKrBZl/X6DfaFgMEwlHqoMgBZtjE1lrtdz:UVpAb
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2512 2160 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 31 PID 2160 wrote to memory of 2512 2160 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 31 PID 2160 wrote to memory of 2512 2160 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 31 PID 2160 wrote to memory of 2512 2160 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 31 PID 2512 wrote to memory of 2568 2512 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 32 PID 2512 wrote to memory of 2568 2512 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 32 PID 2512 wrote to memory of 2568 2512 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 32 PID 2512 wrote to memory of 2568 2512 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 32 PID 2568 wrote to memory of 2572 2568 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 33 PID 2568 wrote to memory of 2572 2568 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 33 PID 2568 wrote to memory of 2572 2568 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 33 PID 2568 wrote to memory of 2572 2568 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 33 PID 2572 wrote to memory of 2668 2572 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 34 PID 2572 wrote to memory of 2668 2572 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 34 PID 2572 wrote to memory of 2668 2572 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 34 PID 2572 wrote to memory of 2668 2572 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 34 PID 2668 wrote to memory of 2556 2668 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 35 PID 2668 wrote to memory of 2556 2668 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 35 PID 2668 wrote to memory of 2556 2668 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 35 PID 2668 wrote to memory of 2556 2668 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 35 PID 2556 wrote to memory of 2452 2556 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 36 PID 2556 wrote to memory of 2452 2556 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 36 PID 2556 wrote to memory of 2452 2556 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 36 PID 2556 wrote to memory of 2452 2556 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 36 PID 2452 wrote to memory of 2108 2452 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 37 PID 2452 wrote to memory of 2108 2452 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 37 PID 2452 wrote to memory of 2108 2452 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 37 PID 2452 wrote to memory of 2108 2452 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 37 PID 2108 wrote to memory of 2156 2108 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 38 PID 2108 wrote to memory of 2156 2108 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 38 PID 2108 wrote to memory of 2156 2108 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 38 PID 2108 wrote to memory of 2156 2108 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 38 PID 2156 wrote to memory of 2164 2156 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 39 PID 2156 wrote to memory of 2164 2156 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 39 PID 2156 wrote to memory of 2164 2156 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 39 PID 2156 wrote to memory of 2164 2156 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 39 PID 2164 wrote to memory of 944 2164 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 40 PID 2164 wrote to memory of 944 2164 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 40 PID 2164 wrote to memory of 944 2164 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 40 PID 2164 wrote to memory of 944 2164 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 40 PID 944 wrote to memory of 1520 944 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 41 PID 944 wrote to memory of 1520 944 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 41 PID 944 wrote to memory of 1520 944 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 41 PID 944 wrote to memory of 1520 944 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 41 PID 1520 wrote to memory of 2304 1520 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 42 PID 1520 wrote to memory of 2304 1520 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 42 PID 1520 wrote to memory of 2304 1520 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 42 PID 1520 wrote to memory of 2304 1520 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 42 PID 2304 wrote to memory of 1860 2304 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 43 PID 2304 wrote to memory of 1860 2304 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 43 PID 2304 wrote to memory of 1860 2304 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 43 PID 2304 wrote to memory of 1860 2304 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 43 PID 1860 wrote to memory of 2952 1860 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 44 PID 1860 wrote to memory of 2952 1860 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 44 PID 1860 wrote to memory of 2952 1860 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 44 PID 1860 wrote to memory of 2952 1860 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 44 PID 2952 wrote to memory of 2100 2952 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 76 PID 2952 wrote to memory of 2100 2952 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 76 PID 2952 wrote to memory of 2100 2952 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 76 PID 2952 wrote to memory of 2100 2952 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 76 PID 2100 wrote to memory of 2280 2100 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 46 PID 2100 wrote to memory of 2280 2100 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 46 PID 2100 wrote to memory of 2280 2100 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 46 PID 2100 wrote to memory of 2280 2100 3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"9⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"11⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"12⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"13⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"14⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"16⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"17⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"18⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"19⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"20⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"21⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"22⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"23⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"24⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"25⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"26⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"27⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"28⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"29⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"30⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"31⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"32⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"33⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"34⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"35⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"36⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"37⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"38⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"39⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"40⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"41⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"42⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"43⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"44⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"45⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"46⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"47⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"48⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"49⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"50⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"51⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"52⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"53⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"54⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"55⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"56⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"57⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"58⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"59⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"60⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"61⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"62⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"63⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"64⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"65⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"66⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"67⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"68⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"69⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"70⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"71⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"72⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"73⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"74⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"75⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"76⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"77⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"78⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"79⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"80⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"81⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"82⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"83⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"84⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"85⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"86⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"87⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"88⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"89⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"90⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"91⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"92⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"93⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"94⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"95⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"96⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"97⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"98⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"99⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"100⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"101⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"102⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"103⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"104⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"105⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"106⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"107⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"108⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"109⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"110⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"111⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"112⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"113⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"114⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"115⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"116⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"117⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"118⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"119⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"120⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"121⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3022e32456f79f6b5c98eee161cc2c59_JaffaCakes118.exe"122⤵PID:776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-