Overview

overview

7

Static

static

3

68dafc7426...18.exe

windows7-x64

7

68dafc7426...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    15s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/10/2024, 04:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
  • Size 1.6MB
  • Sample241022-ethg8ayemk
  • SHA256 07715a7b7e3be78522eaddf7d0b02b78f0b28ee6ab47081bd7e68d6abb5d46ac
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4184
      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5108
          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
            5⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:928
            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
              6⤵
                PID:5304
                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                  7⤵
                    PID:6280
                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                      8⤵
                        PID:10156
                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                          9⤵
                            PID:4508
                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                          8⤵
                            PID:13688
                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                            8⤵
                              PID:1564
                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                            7⤵
                              PID:7940
                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                8⤵
                                  PID:15744
                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                  8⤵
                                    PID:17812
                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                  7⤵
                                    PID:10572
                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                    7⤵
                                      PID:15220
                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                      7⤵
                                        PID:60
                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                      6⤵
                                        PID:5396
                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                          7⤵
                                            PID:7740
                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                              8⤵
                                                PID:15764
                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                8⤵
                                                  PID:5004
                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                7⤵
                                                  PID:10388
                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                  7⤵
                                                    PID:14592
                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                    7⤵
                                                      PID:5312
                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                    6⤵
                                                      PID:6736
                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                        7⤵
                                                          PID:12240
                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                          7⤵
                                                            PID:6568
                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                          6⤵
                                                            PID:8896
                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                              7⤵
                                                                PID:7220
                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                              6⤵
                                                                PID:12732
                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                6⤵
                                                                  PID:2260
                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                5⤵
                                                                  PID:540
                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                    6⤵
                                                                      PID:6296
                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                        7⤵
                                                                          PID:10108
                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                            8⤵
                                                                              PID:18280
                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                            7⤵
                                                                              PID:13388
                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                              7⤵
                                                                                PID:17852
                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                              6⤵
                                                                                PID:7908
                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                  7⤵
                                                                                    PID:15784
                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                    7⤵
                                                                                      PID:916
                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                    6⤵
                                                                                      PID:10564
                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                      6⤵
                                                                                        PID:15308
                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                        6⤵
                                                                                          PID:3772
                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                        5⤵
                                                                                          PID:5436
                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                            6⤵
                                                                                              PID:8012
                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                7⤵
                                                                                                  PID:16352
                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                  7⤵
                                                                                                    PID:2644
                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                  6⤵
                                                                                                    PID:11052
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                    6⤵
                                                                                                      PID:15752
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                      6⤵
                                                                                                        PID:3164
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                      5⤵
                                                                                                        PID:7132
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                          6⤵
                                                                                                            PID:12416
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                            6⤵
                                                                                                              PID:6548
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                            5⤵
                                                                                                              PID:9684
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                              5⤵
                                                                                                                PID:13520
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                5⤵
                                                                                                                  PID:2868
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                4⤵
                                                                                                                • Checks computer location settings
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:1588
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                  5⤵
                                                                                                                    PID:5332
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                      6⤵
                                                                                                                        PID:6376
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                          7⤵
                                                                                                                            PID:10116
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                            7⤵
                                                                                                                              PID:13376
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                              7⤵
                                                                                                                                PID:1100
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                              6⤵
                                                                                                                                PID:7932
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                  7⤵
                                                                                                                                    PID:15888
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                    7⤵
                                                                                                                                      PID:4992
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                    6⤵
                                                                                                                                      PID:10596
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                      6⤵
                                                                                                                                        PID:15068
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                        6⤵
                                                                                                                                          PID:824
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                        5⤵
                                                                                                                                          PID:5500
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                            6⤵
                                                                                                                                              PID:8820
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                7⤵
                                                                                                                                                  PID:2860
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                6⤵
                                                                                                                                                  PID:11972
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                  6⤵
                                                                                                                                                    PID:3320
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                  5⤵
                                                                                                                                                    PID:7360
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                      6⤵
                                                                                                                                                        PID:12408
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                        6⤵
                                                                                                                                                          PID:6336
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                        5⤵
                                                                                                                                                          PID:9452
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                            6⤵
                                                                                                                                                              PID:1164
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                            5⤵
                                                                                                                                                              PID:13008
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                              5⤵
                                                                                                                                                                PID:2148
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                              4⤵
                                                                                                                                                                PID:5184
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:6240
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:10164
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:13560
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:5244
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:7852
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:7264
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:10740
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:15240
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:17828
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:5404
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:7732
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:16360
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:17808
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:10372
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:14604
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:17844
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:6816
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:13100
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:5576
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:9128
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:7256
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:12812
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:5856
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                            PID:4068
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                              PID:3028
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:5140
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:6248
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                        PID:11108
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                          PID:15924
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                            PID:4484
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:7832
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:15772
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                  PID:5364
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:10500
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:15076
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:1520
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:5412
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:8828
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                              PID:7276
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:12000
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:4596
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:6744
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:12292
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:5148
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:8888
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:4464
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:12648
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:3148
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:3804
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:6312
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:10128
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:13436
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:2060
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:8096
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:7312
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:11228
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:15992
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:3936
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:5468
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:8872
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:400
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                        PID:12676
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:3764
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:6988
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:12400
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                PID:6484
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:9292
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                    PID:3332
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:12852
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:5828
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                    PID:3728
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:1840
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                            PID:6304
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                PID:10508
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                  PID:15040
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                    PID:1344
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                    PID:7724
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                        PID:15408
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                          PID:2012
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                          PID:10188
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                            PID:13940
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                              PID:4784
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:5388
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                  PID:6756
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                      PID:9696
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                        PID:800
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                        PID:8904
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                            PID:6976
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                            PID:12692
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                              PID:5776
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                              PID:6716
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                  PID:12172
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3524
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                    PID:8880
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4396
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                        PID:12656
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3236
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2224
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6328
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:10180
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1332
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:13552
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2972
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:7916
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6852
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:10556
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:15232
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2376
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5484
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7824
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:15592
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5060
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:10364
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:14584
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5340
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:7116
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:13092
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:9416
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:12896
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:724
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                            PID:8
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6256
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10172
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13544
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4060
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7924
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6864
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10588
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:15136
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8792
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6644
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11888
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6996
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12032
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:592
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9300
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:17840
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12820
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6208
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:15604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:14620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:12904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:15712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:14628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:15736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:18284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:16424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:15164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:17832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:17860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:15200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:15612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:17816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:16104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:16368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:15216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:16224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:17940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:17888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:14608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:15208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:17288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:18368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\68dafc74265a54b7f44a47269fbbe588_JaffaCakes118.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4320

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  british bukkake [free] titts .mpeg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\british bukkake [free] titts .mpeg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 830KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d477b9bcdbadad991d369635356f1b4dfdf2b87a9eefc92a6b08dfc313ce266e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download