Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 03:58
Static task
static1
Behavioral task
behavioral1
Sample
ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe
-
Size
840KB
-
MD5
ea8af2084e4985610755a9a0bab16423
-
SHA1
ff700d848406796dbc96d760788b811080f26299
-
SHA256
41dd2b2418f31fe8fb7bec8eb7b528992503cfabd2692bedcbfd3a23facb3285
-
SHA512
bae84c44f98b09c63cce7a35b3d57d2ff92b63ac82887b75432f771ea897aa3fa1a3132dca00d65ee379617bcbe7bb7556e8f4c3f5542ea315f8d4b6cbf9b2c5
-
SSDEEP
12288:hnrjX0GNBXib8Fs/jwApY0XOaIQi0g0yDT1s11gUlQFyeE7aZoCSe6EXwiLs27ft:hXfNBXho20+tPYCW1tidlyPbYqOz
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 3660 4816 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 81 PID 4816 wrote to memory of 3660 4816 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 81 PID 3660 wrote to memory of 1892 3660 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 82 PID 3660 wrote to memory of 1892 3660 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 82 PID 1892 wrote to memory of 1652 1892 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 83 PID 1892 wrote to memory of 1652 1892 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 83 PID 1652 wrote to memory of 388 1652 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 84 PID 1652 wrote to memory of 388 1652 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 84 PID 388 wrote to memory of 2324 388 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 85 PID 388 wrote to memory of 2324 388 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 85 PID 2324 wrote to memory of 688 2324 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 86 PID 2324 wrote to memory of 688 2324 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 86 PID 688 wrote to memory of 4208 688 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 87 PID 688 wrote to memory of 4208 688 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 87 PID 4208 wrote to memory of 4492 4208 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 218 PID 4208 wrote to memory of 4492 4208 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 218 PID 4492 wrote to memory of 3220 4492 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 89 PID 4492 wrote to memory of 3220 4492 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 89 PID 3220 wrote to memory of 3168 3220 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 90 PID 3220 wrote to memory of 3168 3220 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 90 PID 3168 wrote to memory of 3148 3168 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 91 PID 3168 wrote to memory of 3148 3168 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 91 PID 3148 wrote to memory of 708 3148 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 138 PID 3148 wrote to memory of 708 3148 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 138 PID 708 wrote to memory of 1568 708 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 93 PID 708 wrote to memory of 1568 708 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 93 PID 1568 wrote to memory of 1956 1568 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 179 PID 1568 wrote to memory of 1956 1568 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 179 PID 1956 wrote to memory of 2520 1956 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 95 PID 1956 wrote to memory of 2520 1956 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 95 PID 2520 wrote to memory of 3040 2520 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 96 PID 2520 wrote to memory of 3040 2520 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 96 PID 3040 wrote to memory of 5008 3040 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 97 PID 3040 wrote to memory of 5008 3040 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 97 PID 5008 wrote to memory of 1764 5008 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 98 PID 5008 wrote to memory of 1764 5008 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 98 PID 1764 wrote to memory of 1212 1764 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 99 PID 1764 wrote to memory of 1212 1764 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 99 PID 1212 wrote to memory of 3988 1212 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 100 PID 1212 wrote to memory of 3988 1212 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 100 PID 3988 wrote to memory of 4360 3988 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 228 PID 3988 wrote to memory of 4360 3988 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 228 PID 4360 wrote to memory of 4456 4360 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 102 PID 4360 wrote to memory of 4456 4360 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 102 PID 4456 wrote to memory of 3328 4456 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 189 PID 4456 wrote to memory of 3328 4456 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 189 PID 3328 wrote to memory of 3956 3328 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 190 PID 3328 wrote to memory of 3956 3328 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 190 PID 3956 wrote to memory of 3248 3956 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 105 PID 3956 wrote to memory of 3248 3956 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 105 PID 3248 wrote to memory of 3460 3248 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 106 PID 3248 wrote to memory of 3460 3248 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 106 PID 3460 wrote to memory of 900 3460 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 107 PID 3460 wrote to memory of 900 3460 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 107 PID 900 wrote to memory of 2372 900 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 236 PID 900 wrote to memory of 2372 900 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 236 PID 2372 wrote to memory of 3280 2372 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 109 PID 2372 wrote to memory of 3280 2372 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 109 PID 3280 wrote to memory of 2140 3280 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 238 PID 3280 wrote to memory of 2140 3280 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 238 PID 2140 wrote to memory of 3632 2140 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 239 PID 2140 wrote to memory of 3632 2140 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 239 PID 3632 wrote to memory of 3564 3632 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 240 PID 3632 wrote to memory of 3564 3632 ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe 240
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe5⤵
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe6⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe7⤵
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe8⤵
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe9⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe10⤵
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe11⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe12⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe13⤵
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe14⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe15⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe16⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe17⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe18⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe19⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe20⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe21⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe22⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe23⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe24⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe25⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe26⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe27⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe28⤵
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe29⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe30⤵
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe31⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe32⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe33⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe34⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe35⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe36⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe37⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe38⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe39⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe40⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe41⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe42⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe43⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe44⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe45⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe46⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe47⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe48⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe49⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe50⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe51⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe52⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe53⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe54⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe55⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe56⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe57⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe58⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe59⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe60⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe61⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe62⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe63⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe64⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe65⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe66⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe67⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe68⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe69⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe70⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe71⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe72⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe73⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe74⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe75⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe76⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe77⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe78⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe79⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe80⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe81⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe82⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe83⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe84⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe85⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe86⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe87⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe88⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe89⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe90⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe91⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe92⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe93⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe94⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe95⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe96⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe97⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe98⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe99⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe100⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe101⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe102⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe103⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe104⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe105⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe106⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe107⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe108⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe109⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe110⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe111⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe112⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe113⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe114⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe115⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe116⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe117⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe118⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe119⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe120⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe121⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea8af2084e4985610755a9a0bab16423_JaffaCakes118.exe122⤵PID:1624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-