Analysis
-
max time kernel
145s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-08-2024 20:34
Static task
static1
Behavioral task
behavioral1
Sample
879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe
-
Size
126KB
-
MD5
879406741e41a8987cfe26a346b5618c
-
SHA1
aab1adb6ca9a2c511af69d01b18e96534c80310d
-
SHA256
5ee96d773aa3e0af784f65f7b6981d6153ec525f2ec896459597cce7be2d9dfa
-
SHA512
8945a1b6746ac04008ee8b0b119d2270cceef160fa79cf98c203c92c4920d93e81d8f0275be0eebdc99f3b5d575b5bafaaed61ea35743fb23ef6ecc9802d965f
-
SSDEEP
3072:ggoswCoBM8EBkVpWBYpo0ZTZWvWRsC9idfXP6jOD6g/l3D/AYI:msZoBzEBCW2powtWvpNSEH3bAYI
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2716 wrote to memory of 2772 2716 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 30 PID 2716 wrote to memory of 2772 2716 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 30 PID 2716 wrote to memory of 2772 2716 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 30 PID 2716 wrote to memory of 2772 2716 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 30 PID 2772 wrote to memory of 2796 2772 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 31 PID 2772 wrote to memory of 2796 2772 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 31 PID 2772 wrote to memory of 2796 2772 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 31 PID 2772 wrote to memory of 2796 2772 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 31 PID 2796 wrote to memory of 2868 2796 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 32 PID 2796 wrote to memory of 2868 2796 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 32 PID 2796 wrote to memory of 2868 2796 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 32 PID 2796 wrote to memory of 2868 2796 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 32 PID 2868 wrote to memory of 3004 2868 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 33 PID 2868 wrote to memory of 3004 2868 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 33 PID 2868 wrote to memory of 3004 2868 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 33 PID 2868 wrote to memory of 3004 2868 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 33 PID 3004 wrote to memory of 2720 3004 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 34 PID 3004 wrote to memory of 2720 3004 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 34 PID 3004 wrote to memory of 2720 3004 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 34 PID 3004 wrote to memory of 2720 3004 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 34 PID 2720 wrote to memory of 2996 2720 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 35 PID 2720 wrote to memory of 2996 2720 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 35 PID 2720 wrote to memory of 2996 2720 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 35 PID 2720 wrote to memory of 2996 2720 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 35 PID 2996 wrote to memory of 2696 2996 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 36 PID 2996 wrote to memory of 2696 2996 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 36 PID 2996 wrote to memory of 2696 2996 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 36 PID 2996 wrote to memory of 2696 2996 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 36 PID 2696 wrote to memory of 2788 2696 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 37 PID 2696 wrote to memory of 2788 2696 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 37 PID 2696 wrote to memory of 2788 2696 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 37 PID 2696 wrote to memory of 2788 2696 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 37 PID 2788 wrote to memory of 2792 2788 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 38 PID 2788 wrote to memory of 2792 2788 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 38 PID 2788 wrote to memory of 2792 2788 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 38 PID 2788 wrote to memory of 2792 2788 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 38 PID 2792 wrote to memory of 2760 2792 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 39 PID 2792 wrote to memory of 2760 2792 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 39 PID 2792 wrote to memory of 2760 2792 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 39 PID 2792 wrote to memory of 2760 2792 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 39 PID 2760 wrote to memory of 2376 2760 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 40 PID 2760 wrote to memory of 2376 2760 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 40 PID 2760 wrote to memory of 2376 2760 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 40 PID 2760 wrote to memory of 2376 2760 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 40 PID 2376 wrote to memory of 2992 2376 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 41 PID 2376 wrote to memory of 2992 2376 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 41 PID 2376 wrote to memory of 2992 2376 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 41 PID 2376 wrote to memory of 2992 2376 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 41 PID 2992 wrote to memory of 2684 2992 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 42 PID 2992 wrote to memory of 2684 2992 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 42 PID 2992 wrote to memory of 2684 2992 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 42 PID 2992 wrote to memory of 2684 2992 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 42 PID 2684 wrote to memory of 2888 2684 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 43 PID 2684 wrote to memory of 2888 2684 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 43 PID 2684 wrote to memory of 2888 2684 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 43 PID 2684 wrote to memory of 2888 2684 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 43 PID 2888 wrote to memory of 2396 2888 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 44 PID 2888 wrote to memory of 2396 2888 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 44 PID 2888 wrote to memory of 2396 2888 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 44 PID 2888 wrote to memory of 2396 2888 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 44 PID 2396 wrote to memory of 2936 2396 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 45 PID 2396 wrote to memory of 2936 2396 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 45 PID 2396 wrote to memory of 2936 2396 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 45 PID 2396 wrote to memory of 2936 2396 879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe5⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe6⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe7⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe8⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe9⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe10⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe11⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe12⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe13⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe14⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe15⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe16⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe17⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe18⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe19⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe20⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe21⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe22⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe23⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe24⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe25⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe26⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe27⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe28⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe29⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe30⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe31⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe32⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe33⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe34⤵
- System Location Discovery: System Language Discovery
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe35⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe36⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe37⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe38⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe39⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe40⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe41⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe42⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe43⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe44⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe45⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe46⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe47⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe48⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe49⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe50⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe51⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe52⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe53⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe54⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe55⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe56⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe57⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe58⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe59⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe60⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe61⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe62⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe63⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe64⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe65⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe66⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe67⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe68⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe69⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe70⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe71⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe72⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe73⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe74⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe75⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe76⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe77⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe78⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe79⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe80⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe81⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe82⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe83⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe84⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe85⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe86⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe87⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe88⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe89⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe90⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe91⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe92⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe93⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe94⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe95⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe96⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe97⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe98⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe99⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe100⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe101⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe102⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe103⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe104⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe105⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe106⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe107⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe108⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe109⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe110⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe111⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe112⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe113⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe114⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe115⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe116⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe117⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe118⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe119⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe120⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe121⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\\879406741e41a8987cfe26a346b5618c_JaffaCakes118.exe122⤵PID:2000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-