73a98a6b391f978179322edba6ab525d86adba220ab4ed219b8f9ecec021959b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
Size

1.0MB
MD5

73ac3d3671c55618e31e2e3d668d3186
SHA1

dbb54bed305f77af2cb299ac843e9e0a137ef65c
SHA256

73a98a6b391f978179322edba6ab525d86adba220ab4ed219b8f9ecec021959b
SHA512

1bebe1e36321817662f07eff1d2e30bce155482aeb2a7ea5171b6a8e471d4f8cd65dde6eb10d27a5e18b05b9ece824de90027d5102b1c53a67ee9fd1a6381f1d
SSDEEP

24576:pRfype0AqV38mJNv3/AbEYnwf3W8QgJO/CwBSmq28wy5kYc:pR6peU8m7/A/nQikO3smq2FkkR

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5212	4480	WerFault.exe	81
5296	4480	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 3848	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	85
PID 4480 wrote to memory of 3848	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	85
PID 4480 wrote to memory of 3848	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	85
PID 4480 wrote to memory of 2012	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	86
PID 4480 wrote to memory of 2012	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	86
PID 4480 wrote to memory of 2012	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	86
PID 4480 wrote to memory of 1780	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	87
PID 4480 wrote to memory of 1780	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	87
PID 4480 wrote to memory of 1780	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	87
PID 4480 wrote to memory of 1292	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	88
PID 4480 wrote to memory of 1292	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	88
PID 4480 wrote to memory of 1292	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	88
PID 4480 wrote to memory of 2652	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	89
PID 4480 wrote to memory of 2652	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	89
PID 4480 wrote to memory of 2652	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	89
PID 4480 wrote to memory of 2260	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	90
PID 4480 wrote to memory of 2260	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	90
PID 4480 wrote to memory of 2260	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	90
PID 4480 wrote to memory of 3692	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	91
PID 4480 wrote to memory of 3692	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	91
PID 4480 wrote to memory of 3692	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	91
PID 4480 wrote to memory of 5100	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	92
PID 4480 wrote to memory of 5100	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	92
PID 4480 wrote to memory of 5100	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	92
PID 4480 wrote to memory of 4388	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	93
PID 4480 wrote to memory of 4388	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	93
PID 4480 wrote to memory of 4388	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	93
PID 4480 wrote to memory of 4724	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	94
PID 4480 wrote to memory of 4724	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	94
PID 4480 wrote to memory of 4724	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	94
PID 4480 wrote to memory of 1800	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	95
PID 4480 wrote to memory of 1800	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	95
PID 4480 wrote to memory of 1800	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	95
PID 4480 wrote to memory of 1332	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	96
PID 4480 wrote to memory of 1332	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	96
PID 4480 wrote to memory of 1332	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	96
PID 4480 wrote to memory of 1476	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	97
PID 4480 wrote to memory of 1476	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	97
PID 4480 wrote to memory of 1476	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	97
PID 4480 wrote to memory of 1464	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	98
PID 4480 wrote to memory of 1464	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	98
PID 4480 wrote to memory of 1464	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	98
PID 4480 wrote to memory of 2472	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	99
PID 4480 wrote to memory of 2472	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	99
PID 4480 wrote to memory of 2472	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	99
PID 4480 wrote to memory of 1872	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	100
PID 4480 wrote to memory of 1872	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	100
PID 4480 wrote to memory of 1872	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	100
PID 4480 wrote to memory of 2044	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	101
PID 4480 wrote to memory of 2044	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	101
PID 4480 wrote to memory of 2044	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	101
PID 4480 wrote to memory of 2448	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	102
PID 4480 wrote to memory of 2448	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	102
PID 4480 wrote to memory of 2448	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	102
PID 4480 wrote to memory of 2848	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	103
PID 4480 wrote to memory of 2848	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	103
PID 4480 wrote to memory of 2848	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	103
PID 4480 wrote to memory of 3468	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	104
PID 4480 wrote to memory of 3468	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	104
PID 4480 wrote to memory of 3468	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	104
PID 4480 wrote to memory of 4496	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	105
PID 4480 wrote to memory of 4496	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	105
PID 4480 wrote to memory of 4496	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	105
PID 4480 wrote to memory of 4472	4480	73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe	106

C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3848
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2012
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1780
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1292
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2652
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2260
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3692
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:5100
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4388
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4724
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1800
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1332
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1476
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1464
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2472
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1872
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2044
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2448
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2848
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3468
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4496
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4472
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:552
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4740
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1868
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4008
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:640
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3448
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:748
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4424
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4256
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3496
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3380
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:420
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3784
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2284
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2032
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1248
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3832
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3264
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3532
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4808
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4732
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:5020
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4140
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3628
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4996
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4820
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2600
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4656
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3312
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:60
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:408
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1036
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1256
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3256
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:8
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3084
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:664
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4644
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4332
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2336
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2668
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4396
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2980
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1608
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:652
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4024
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1316
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4572
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:216
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4588
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:5068
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4128
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:744
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3984
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2004
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:452
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:392
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4268
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4464
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4460
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3268
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1556
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2300
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4220
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4624
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:856
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3520
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1184
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4068
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3996
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4888
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:996
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1484
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4756
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:880
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2928
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3752
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1108
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:5108
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4840
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3228
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3540
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:912
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1536
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4416
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4500
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1100
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1972
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2316
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2128
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4520
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2352
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4640
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:5028
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4856
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4184
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2436
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2992
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:5008
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4764
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2948
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3808
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1068
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3304
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4660
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3896
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:944
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:5044
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2516
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1864
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1756
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3064
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:5024
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2952
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2228
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4736
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1084
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2748
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3736
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4980
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3980
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1760
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:5012
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3100
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2148
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3140
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1784
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1432
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1420
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2996
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4504
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2244
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1368
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3756
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:788
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3696
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:772
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:708
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3040
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3196
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4400
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4636
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4120
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1884
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:5064
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4232
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:692
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4316
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3004
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2400
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3716
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3760
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3012
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4080
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3444
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4568
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3580
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3348
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4340
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:4344
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1380
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2440
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3836
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3308
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1552
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2572
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3328
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1540
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2188
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1908
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1436
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:2540
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:1236
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:3208
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:5128
- C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\73ac3d3671c55618e31e2e3d668d3186_JaffaCakes118.exe
  2⤵
  PID:5136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 244
  2⤵
  - Program crash
  PID:5212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 264
  2⤵
  - Program crash
  PID:5296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4480 -ip 4480
1⤵
PID:5184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4480 -ip 4480
1⤵
PID:5276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4480-0-0x0000000002FC0000-0x0000000002FC5000-memory.dmp

Filesize
20KB

Download