c981ea84b4a400b3324bf83d8b8a5db147cf8f6d02cf693520c4f38e1550c726

Analysis

max time kernel
66s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
Size

1.1MB
MD5

0494a2bc6f6b41cdf454b43672e8b3d2
SHA1

f4b36636be1a72438b987f4776b22992d849ae6c
SHA256

c981ea84b4a400b3324bf83d8b8a5db147cf8f6d02cf693520c4f38e1550c726
SHA512

46a111f564d1436de77d144c498cb507a18850b2e4593423ab5b0e7603521472d5044b69b12e9ea69cd06b13fc3b0dbcd60fc897fdc2a36e220d19c73c06856a
SSDEEP

24576:Vnk45sTSXjL/3ELQxVgoyUirctAsEp5Q6XJlhrQd:VzsTSXX8QcoRGcCZXjJl0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3444 2144 WerFault.exe 0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe

pid process

2144 0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
2144 0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe

pid process

2144 0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe

pid	pid_target	process	target process
3444	2144	WerFault.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe

pid	process
2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe

pid	process
2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4236
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2992
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4532
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3360
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2460
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4384
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4948
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2928
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1200
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:5112
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3088
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4592
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1804
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3260
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4280
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3920
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4520
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1324
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4092
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2216
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2952
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4624
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:696
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4660
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1596
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:5104
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3064
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3332
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2060
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1552
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3896
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4912
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4904
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2028
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:5008
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3548
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3208
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2220
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1784
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4844
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3808
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4776
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:436
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3872
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2964
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:760
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3740
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3624
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3408
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2024
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2080
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3468
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2188
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:456
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4344
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2892
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4524
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4804
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1384
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1936
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2004
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2960
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2096
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3884
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4600
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1456
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4212
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2972
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4452
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2320
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3336
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3164
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:932
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2628
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4428
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1156
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3004
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1460
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4024
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3020
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1896
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4052
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4048
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4072
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2468
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:852
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3340
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4868
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3480
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2984
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1360
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:628
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4668
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2912
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4888
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4056
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1952
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2200
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1972
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:464
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4884
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3376
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1268
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4208
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1180
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1816
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1700
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4784
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1852
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:5012
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2908
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2864
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1172
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1084
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3928
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3076
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4328
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2192
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3284
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4648
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3024
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3492
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2592
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4028
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3772
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4560
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4968
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1872
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4120
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4736
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1208
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2416
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2300
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3356
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4436
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4632
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1220
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3148
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4728
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2132
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4060
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1512
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3968
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2464
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4640
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3324
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1412
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2476
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1196
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4848
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4792
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:5068
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:404
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4864
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1684
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:5000
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3700
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3796
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2660
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2452
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:396
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3924
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3636
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1964
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2224
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3844
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4008
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3472
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3160
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:432
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:768
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4100
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4032
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3572
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1584
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:912
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:5004
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3168
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1132
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3732
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4936
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:532
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3672
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4420
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3060
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4272
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3688
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:4928
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3068
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2836
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:1592
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3180
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3860
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:3828
- C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
  2⤵
  PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 2152
  2⤵
  - Program crash
  PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2144 -ip 2144
1⤵
PID:2068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2144-0-0x00000000002D0000-0x00000000002D5000-memory.dmp

Filesize
20KB

Download

description	pid	process	target process
PID 2144 wrote to memory of 4236	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4236	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4236	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2992	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2992	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2992	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4532	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4532	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4532	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 3360	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 3360	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 3360	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2460	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2460	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2460	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4384	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4384	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4384	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4948	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4948	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4948	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2928	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2928	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2928	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 1200	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 1200	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 1200	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 5112	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 5112	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 5112	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 3088	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 3088	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 3088	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4592	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4592	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4592	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 1804	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 1804	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 1804	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 3260	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 3260	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 3260	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4280	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4280	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4280	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 3920	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 3920	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 3920	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4520	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4520	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4520	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2500	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2500	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2500	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 1324	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 1324	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 1324	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4092	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4092	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 4092	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2216	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2216	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2216	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe
PID 2144 wrote to memory of 2952	2144	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe	0494a2bc6f6b41cdf454b43672e8b3d2_JaffaCakes118.exe