darktrack | 143ca382177b6c4589e841d40b278271be045551ad8a33f24b169106ceac70d8

Analysis

max time kernel
98s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Size 700KB
Sample240329-k638caef23
SHA256 143ca382177b6c4589e841d40b278271be045551ad8a33f24b169106ceac70d8
MD5 1e3777710e6fc8f141ce09c97f61a127
SHA1 4437c9f32fe48c86382b784c3fd1bac86482378e
SHA512 4c8e5a0673dc3ac812cec91147d30fbc2b44a0da5e68fa9df513554f7a238190296bb16fd83db7daf2d30c8f4b147bbfffc3028ef3316b1ddf1a35541ffbc422
SSDEEP 12288:mD8edYIV/jVbOzS7JIHRuzLu7sCeQvLTG1XEn+8sNQIAD5qpffAIusjc6R:68edF/pEgJFOJG10fs1N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darktrack persistence rat stealer

Malware Config

Signatures

DarkTrack
DarkTrack is a remote administration tool written in delphi.
rat stealer darktrack

DarkTrack payload 32 IoCs

resource	yara_rule
behavioral1/memory/2984-8-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2984-9-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2984-10-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2984-11-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2984-12-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2984-13-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2984-16-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2984-17-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2984-19-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2984-20-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2984-21-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2984-57-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/776-80-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/776-82-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2624-163-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2624-174-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2000-184-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2000-188-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/776-190-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1780-207-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1780-211-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1064-231-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1064-233-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2976-248-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2976-252-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1624-271-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1624-273-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2408-293-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2408-297-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2820-322-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2820-324-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1432-343-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack

Executes dropped EXE 2 IoCs

pid	Process
2452	DtServ32.exe
776	DtServ32.exe

Loads dropped DLL 2 IoCs

pid	Process
2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2452	DtServ32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\DtServ32sm.exe = "C:\\Users\\Admin\\AppData\\Roaming\\DtServ32.exe"	notepad.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2988 set thread context of 2984	2988	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	28
PID 2452 set thread context of 776	2452	DtServ32.exe	34
PID 1180 set thread context of 2624	1180	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	38
PID 1952 set thread context of 2000	1952	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	41
PID 1448 set thread context of 1780	1448	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	43
PID 1248 set thread context of 1064	1248	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	45
PID 1708 set thread context of 2976	1708	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	47
PID 1512 set thread context of 1624	1512	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	49
PID 2528 set thread context of 2408	2528	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	51
PID 2376 set thread context of 2820	2376	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	53
PID 2304 set thread context of 1432	2304	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	55
PID 1644 set thread context of 1528	1644	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	57
PID 1740 set thread context of 980	1740	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	59
PID 2724 set thread context of 696	2724	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	61
PID 2192 set thread context of 1536	2192	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	64
PID 2224 set thread context of 540	2224	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	67
PID 1992 set thread context of 1196	1992	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	69
PID 2736 set thread context of 2632	2736	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	72
PID 1972 set thread context of 2960	1972	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	75
PID 1652 set thread context of 828	1652	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	77
PID 288 set thread context of 1768	288	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	79
PID 1756 set thread context of 956	1756	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	81
PID 564 set thread context of 2212	564	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	83
PID 960 set thread context of 1032	960	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	92
PID 2268 set thread context of 892	2268	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	95
PID 2720 set thread context of 1524	2720	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	97
PID 2468 set thread context of 2640	2468	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	99
PID 2864 set thread context of 2696	2864	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	103
PID 1420 set thread context of 2448	1420	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	105
PID 2164 set thread context of 636	2164	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	113
PID 2568 set thread context of 1440	2568	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	115
PID 1084 set thread context of 2244	1084	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	117
PID 3052 set thread context of 1064	3052	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	119
PID 2064 set thread context of 2264	2064	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	122
PID 1232 set thread context of 2308	1232	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	124
PID 2688 set thread context of 2416	2688	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	126
PID 572 set thread context of 2008	572	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	128
PID 1696 set thread context of 1452	1696	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	130
PID 1388 set thread context of 1528	1388	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	132
PID 2916 set thread context of 2972	2916	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	134
PID 1324 set thread context of 2232	1324	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	136
PID 2788 set thread context of 488	2788	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	138
PID 2628 set thread context of 2884	2628	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	141
PID 1808 set thread context of 344	1808	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	145
PID 2312 set thread context of 544	2312	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	147
PID 1608 set thread context of 1748	1608	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	149
PID 1752 set thread context of 2056	1752	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	153
PID 2768 set thread context of 1312	2768	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	156
PID 1552 set thread context of 1584	1552	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	159
PID 2988 set thread context of 2460	2988	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	161
PID 2572 set thread context of 2440	2572	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	167
PID 2404 set thread context of 344	2404	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	171
PID 3068 set thread context of 308	3068	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	195
PID 2472 set thread context of 324	2472	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	182
PID 2244 set thread context of 1028	2244	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	184
PID 2504 set thread context of 1596	2504	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	186
PID 2372 set thread context of 1684	2372	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	188
PID 2884 set thread context of 2100	2884	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	191
PID 2188 set thread context of 1760	2188	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	193
PID 544 set thread context of 760	544	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	196
PID 1812 set thread context of 868	1812	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	201
PID 1548 set thread context of 924	1548	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	203
PID 1944 set thread context of 488	1944	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	205
PID 2492 set thread context of 1524	2492	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	208

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1952	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1952	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2736	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2736	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1972	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1972	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
588	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
588	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
588	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
588	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
588	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
588	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
588	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
588	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
588	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
588	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
960	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
960	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2268	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2268	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2864	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2864	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2864	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2864	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1800	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1800	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1800	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1800	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1800	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1800	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1800	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1800	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1800	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1800	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2064	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2064	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2628	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2628	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1752	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1752	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1752	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1752	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2768	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2768	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1552	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
1552	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2572	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2572	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2572	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2572	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2572	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2572	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2572	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2572	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2404	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2404	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2404	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2404	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3068	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
3068	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2620	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2620	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2620	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
2620	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
776	DtServ32.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	1952	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2736	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1972	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	588	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	960	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2268	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2864	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1800	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2064	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2628	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1752	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2768	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1552	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2572	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2404	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	3068	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2620	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2884	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	544	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1812	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2492	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2120	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	3060	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	828	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2708	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2940	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2424	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2496	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2564	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1064	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1596	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1648	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2704	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1908	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2068	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1612	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1332	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	980	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2780	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2892	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1460	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	936	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1964	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2412	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1976	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	1536	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
Token: SeDebugPrivilege	2176	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2984	2988	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2984	2988	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2984	2988	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2984	2988	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2984	2988	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2984	2988	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2984	2988	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2984	2988	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2984	2988	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2984	2988	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2984	2988	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2984	2988	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2984	2988	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	28
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2508	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2376	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	30
PID 2984 wrote to memory of 2376	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	30
PID 2984 wrote to memory of 2376	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	30
PID 2984 wrote to memory of 2376	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	30
PID 2984 wrote to memory of 2452	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	32
PID 2984 wrote to memory of 2452	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	32
PID 2984 wrote to memory of 2452	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	32
PID 2984 wrote to memory of 2452	2984	1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe	32
PID 2508 wrote to memory of 1572	2508	notepad.exe	33
PID 2508 wrote to memory of 1572	2508	notepad.exe	33
PID 2508 wrote to memory of 1572	2508	notepad.exe	33
PID 2508 wrote to memory of 1572	2508	notepad.exe	33
PID 2452 wrote to memory of 776	2452	DtServ32.exe	34
PID 2452 wrote to memory of 776	2452	DtServ32.exe	34
PID 2452 wrote to memory of 776	2452	DtServ32.exe	34
PID 2452 wrote to memory of 776	2452	DtServ32.exe	34
PID 2452 wrote to memory of 776	2452	DtServ32.exe	34
PID 2452 wrote to memory of 776	2452	DtServ32.exe	34
PID 2452 wrote to memory of 776	2452	DtServ32.exe	34
PID 2452 wrote to memory of 776	2452	DtServ32.exe	34
PID 2452 wrote to memory of 776	2452	DtServ32.exe	34
PID 2452 wrote to memory of 776	2452	DtServ32.exe	34
PID 2452 wrote to memory of 776	2452	DtServ32.exe	34
PID 2452 wrote to memory of 776	2452	DtServ32.exe	34
PID 2452 wrote to memory of 776	2452	DtServ32.exe	34
PID 776 wrote to memory of 1400	776	DtServ32.exe	35
PID 776 wrote to memory of 1400	776	DtServ32.exe	35
PID 776 wrote to memory of 1400	776	DtServ32.exe	35

C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:980
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:696
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:540
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:828
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:288
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:956
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:564
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:588
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:960
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:984
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:892
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:636
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:572
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:488
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:344
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:544
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1312
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:344
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:308
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:324
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:544
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:308
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:760
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:440
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:868
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:924
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:488
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:872
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:828
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:760
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:540
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:760
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:980
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:600
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:920
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:112
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:956
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:268
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:980
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:344
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:488
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:568
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:936
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:872
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:320
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:568
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:112
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:476
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:528
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:600
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:764
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:872
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:344
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:868
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:112
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:488
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:488
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:868
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:280
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:268
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:344
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:568
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:344
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:944
  - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
      4⤵
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1e3777710e6fc8f141ce09c97f61a127_JaffaCakes118.exe"
        5⤵
        
        PID:1224
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1E3777~1.EXE >> NUL
    3⤵
    PID:2376
- - C:\Users\Admin\AppData\Roaming\DtServ32.exe
    "C:\Users\Admin\AppData\Roaming\DtServ32.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Users\Admin\AppData\Roaming\DtServ32.exe
      "C:\Users\Admin\AppData\Roaming\DtServ32.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:776
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:1400
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        Adds Run key to start application
        
        PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DtServ32.exe

Path \Users\Admin\AppData\Roaming\DtServ32.exe
Size 700KB
SHA256 143ca382177b6c4589e841d40b278271be045551ad8a33f24b169106ceac70d8
MD5 1e3777710e6fc8f141ce09c97f61a127
SHA1 4437c9f32fe48c86382b784c3fd1bac86482378e
SHA512 4c8e5a0673dc3ac812cec91147d30fbc2b44a0da5e68fa9df513554f7a238190296bb16fd83db7daf2d30c8f4b147bbfffc3028ef3316b1ddf1a35541ffbc422
SSDEEP 12288:mD8edYIV/jVbOzS7JIHRuzLu7sCeQvLTG1XEn+8sNQIAD5qpffAIusjc6R:68edF/pEgJFOJG10fs1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/776-75-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/776-190-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/776-80-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/776-82-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1064-231-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1064-233-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1180-146-0x0000000000B90000-0x0000000000C44000-memory.dmp

Download

memory/1180-161-0x0000000074220000-0x000000007490E000-memory.dmp

Download

memory/1180-148-0x0000000004B10000-0x0000000004B50000-memory.dmp

Download

memory/1180-147-0x0000000074220000-0x000000007490E000-memory.dmp

Download

memory/1248-213-0x00000000022B0000-0x00000000022F0000-memory.dmp

Download

memory/1248-212-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/1248-229-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/1428-144-0x0000000000450000-0x0000000000451000-memory.dmp

Download

memory/1432-343-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1448-189-0x0000000074220000-0x000000007490E000-memory.dmp

Download

memory/1448-208-0x0000000074220000-0x000000007490E000-memory.dmp

Download

memory/1448-191-0x0000000004430000-0x0000000004470000-memory.dmp

Download

memory/1512-253-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/1512-254-0x0000000004770000-0x00000000047B0000-memory.dmp

Download

memory/1512-274-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/1572-64-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/1572-145-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/1572-69-0x0000000004690000-0x00000000046D0000-memory.dmp

Download

memory/1572-66-0x0000000000B90000-0x0000000000C44000-memory.dmp

Download

memory/1624-273-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1624-271-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1708-234-0x0000000074220000-0x000000007490E000-memory.dmp

Download

memory/1708-249-0x0000000074220000-0x000000007490E000-memory.dmp

Download

memory/1780-207-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1780-211-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1952-166-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/1952-185-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/1952-168-0x0000000000A90000-0x0000000000AD0000-memory.dmp

Download

memory/2000-188-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2000-184-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2304-341-0x0000000074220000-0x000000007490E000-memory.dmp

Download

memory/2304-326-0x00000000011C0000-0x0000000001274000-memory.dmp

Download

memory/2304-327-0x0000000004BB0000-0x0000000004BF0000-memory.dmp

Download

memory/2304-325-0x0000000074220000-0x000000007490E000-memory.dmp

Download

memory/2376-320-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/2376-300-0x00000000040B0000-0x00000000040F0000-memory.dmp

Download

memory/2376-299-0x0000000000050000-0x0000000000104000-memory.dmp

Download

memory/2376-298-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/2408-297-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2408-293-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2452-60-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/2452-83-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/2452-62-0x0000000004A40000-0x0000000004A80000-memory.dmp

Download

memory/2452-61-0x0000000000D60000-0x0000000000E14000-memory.dmp

Download

memory/2508-22-0x0000000000100000-0x0000000000101000-memory.dmp

Download

memory/2508-51-0x00000000004D0000-0x00000000004D1000-memory.dmp

Download

memory/2528-276-0x0000000074220000-0x000000007490E000-memory.dmp

Download

memory/2528-296-0x0000000074220000-0x000000007490E000-memory.dmp

Download

memory/2528-277-0x0000000000550000-0x0000000000590000-memory.dmp

Download

memory/2528-275-0x0000000000EF0000-0x0000000000FA4000-memory.dmp

Download

memory/2624-163-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2624-174-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2820-324-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2820-322-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2976-248-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2976-252-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2984-11-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2984-16-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2984-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2984-19-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2984-17-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2984-20-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2984-13-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2984-21-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2984-4-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2984-12-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2984-6-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2984-9-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2984-10-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2984-8-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2984-57-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2988-1-0x0000000074B20000-0x000000007520E000-memory.dmp

Download

memory/2988-18-0x0000000074B20000-0x000000007520E000-memory.dmp

Download

memory/2988-3-0x0000000000250000-0x000000000025A000-memory.dmp

Download

memory/2988-2-0x0000000004B20000-0x0000000004B60000-memory.dmp

Download

memory/2988-0-0x0000000000B90000-0x0000000000C44000-memory.dmp

Download