8323e166ea4ff29525b602184d50dae8f5a066c9138814f998cbbf2ef83b035d

Analysis

max time kernel
134s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
Size

1.0MB
MD5

118f059821b8d4975ffdd1c7b408a0d1
SHA1

b092241b439a2df7b0be6e6d645bbb1c377bdbf6
SHA256

8323e166ea4ff29525b602184d50dae8f5a066c9138814f998cbbf2ef83b035d
SHA512

6e758c0565fce01da897eff280293cf53533e190ddf4441d64ad31fa5686f8e4d39eebe85e21edf4c23e650174957bce2e101e411947eeba8ce84e1e8e3773ad
SSDEEP

24576:/R/QWtd8hGIxNU/j/1e6RrmlcXaP12yZSrsnSWjlmcf8uOqTH4gVlrI:/RoW/8FG11nXk1XSAfFOqTH4gXI

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5232	1760	WerFault.exe	84
5524	1760	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1472	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	85
PID 1760 wrote to memory of 1472	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	85
PID 1760 wrote to memory of 1472	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	85
PID 1760 wrote to memory of 2528	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	86
PID 1760 wrote to memory of 2528	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	86
PID 1760 wrote to memory of 2528	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	86
PID 1760 wrote to memory of 936	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	87
PID 1760 wrote to memory of 936	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	87
PID 1760 wrote to memory of 936	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	87
PID 1760 wrote to memory of 768	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	88
PID 1760 wrote to memory of 768	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	88
PID 1760 wrote to memory of 768	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	88
PID 1760 wrote to memory of 748	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	89
PID 1760 wrote to memory of 748	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	89
PID 1760 wrote to memory of 748	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	89
PID 1760 wrote to memory of 2728	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	90
PID 1760 wrote to memory of 2728	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	90
PID 1760 wrote to memory of 2728	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	90
PID 1760 wrote to memory of 1136	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	91
PID 1760 wrote to memory of 1136	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	91
PID 1760 wrote to memory of 1136	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	91
PID 1760 wrote to memory of 3684	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	92
PID 1760 wrote to memory of 3684	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	92
PID 1760 wrote to memory of 3684	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	92
PID 1760 wrote to memory of 2744	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	93
PID 1760 wrote to memory of 2744	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	93
PID 1760 wrote to memory of 2744	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	93
PID 1760 wrote to memory of 4504	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	94
PID 1760 wrote to memory of 4504	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	94
PID 1760 wrote to memory of 4504	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	94
PID 1760 wrote to memory of 4916	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	95
PID 1760 wrote to memory of 4916	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	95
PID 1760 wrote to memory of 4916	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	95
PID 1760 wrote to memory of 388	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	96
PID 1760 wrote to memory of 388	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	96
PID 1760 wrote to memory of 388	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	96
PID 1760 wrote to memory of 1220	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	97
PID 1760 wrote to memory of 1220	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	97
PID 1760 wrote to memory of 1220	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	97
PID 1760 wrote to memory of 4904	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	98
PID 1760 wrote to memory of 4904	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	98
PID 1760 wrote to memory of 4904	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	98
PID 1760 wrote to memory of 2180	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	99
PID 1760 wrote to memory of 2180	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	99
PID 1760 wrote to memory of 2180	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	99
PID 1760 wrote to memory of 4416	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	100
PID 1760 wrote to memory of 4416	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	100
PID 1760 wrote to memory of 4416	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	100
PID 1760 wrote to memory of 1956	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	101
PID 1760 wrote to memory of 1956	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	101
PID 1760 wrote to memory of 1956	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	101
PID 1760 wrote to memory of 1756	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	102
PID 1760 wrote to memory of 1756	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	102
PID 1760 wrote to memory of 1756	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	102
PID 1760 wrote to memory of 5076	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	103
PID 1760 wrote to memory of 5076	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	103
PID 1760 wrote to memory of 5076	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	103
PID 1760 wrote to memory of 1096	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	104
PID 1760 wrote to memory of 1096	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	104
PID 1760 wrote to memory of 1096	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	104
PID 1760 wrote to memory of 880	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	105
PID 1760 wrote to memory of 880	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	105
PID 1760 wrote to memory of 880	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	105
PID 1760 wrote to memory of 2148	1760	118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe	106

C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1472
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:936
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:768
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:748
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2728
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1136
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3684
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4504
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4916
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:388
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1220
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4904
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2180
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4416
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1956
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1756
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:5076
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1096
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:880
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2148
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4316
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4936
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3136
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3328
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3268
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2016
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1860
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4508
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4500
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:5088
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2144
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3600
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3676
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1708
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4332
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2916
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4656
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3656
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:5032
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3408
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3560
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1596
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4084
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4464
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3192
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:376
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4552
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:844
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4496
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1324
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2168
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3620
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2804
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4944
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:5020
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4324
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2072
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:5100
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1416
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3496
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4876
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4976
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2364
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2988
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2192
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1628
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1424
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2336
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1120
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1276
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3580
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4336
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2448
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:904
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4016
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4264
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3872
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1996
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4412
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4228
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3180
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4268
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2112
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4536
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1616
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:808
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3264
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2132
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3624
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1892
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1400
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3476
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4984
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4176
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1280
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:540
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4064
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1712
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2468
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4528
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4700
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3996
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3696
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4092
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3236
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2004
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1660
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2432
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4188
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:512
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1832
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3468
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:5092
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2816
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:668
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3376
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:5116
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1008
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:532
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4540
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4520
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1588
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4888
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2408
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3976
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:664
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1592
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2492
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3080
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3400
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4072
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3596
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2176
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3464
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4524
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3184
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4452
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2436
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1360
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4512
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1752
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4244
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3612
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1512
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:804
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2368
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3272
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:412
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:368
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2424
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4484
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2732
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1620
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2512
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2280
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:432
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2476
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1952
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4168
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1356
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4036
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2892
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4992
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4756
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3644
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1104
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4576
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2908
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3132
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4120
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4724
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4676
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4920
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1576
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2184
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1108
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1820
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1928
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:1112
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4432
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4572
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4584
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:4396
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:3940
- C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\118f059821b8d4975ffdd1c7b408a0d1_JaffaCakes118.exe
  2⤵
  PID:600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 240
  2⤵
  - Program crash
  PID:5232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 248
  2⤵
  - Program crash
  PID:5524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1760 -ip 1760
1⤵
PID:5180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1760 -ip 1760
1⤵
PID:5504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1760-0-0x00000000003C0000-0x00000000003C5000-memory.dmp

Filesize
20KB

Download