Analysis
-
max time kernel
50s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 04:42
Static task
static1
Behavioral task
behavioral1
Sample
3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe
-
Size
2.1MB
-
MD5
3355034ba93c64f34a7ff7c218f456f1
-
SHA1
64bf7945fc1f7c601536422dfaa9358117a2b613
-
SHA256
94e96ee673c24f5f56ea2ead6368589a9429f918d74d13d7f7a18172e6bb6780
-
SHA512
2e6fafc1e7f207df59b1559a0a18c16cf4f4d114893cbb8e81f770799e59ed9eb8aa4d29e803204be10e2429d48fd3c80a23d158066549cf30b69b7bfbc4c76f
-
SSDEEP
24576:34W4ItalsRI/LXpYr6EdM0oFi75w5iJ/ZUpdo0KfsKsnW+wsDaQw6DDz3qRyPnmQ:3lu0n596d48asY6DwOBfrnvV7UeWtmF
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2576 wrote to memory of 1988 2576 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 30 PID 2576 wrote to memory of 1988 2576 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 30 PID 2576 wrote to memory of 1988 2576 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 30 PID 2576 wrote to memory of 1988 2576 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 30 PID 1988 wrote to memory of 2484 1988 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 31 PID 1988 wrote to memory of 2484 1988 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 31 PID 1988 wrote to memory of 2484 1988 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 31 PID 1988 wrote to memory of 2484 1988 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 31 PID 2484 wrote to memory of 1048 2484 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 32 PID 2484 wrote to memory of 1048 2484 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 32 PID 2484 wrote to memory of 1048 2484 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 32 PID 2484 wrote to memory of 1048 2484 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 32 PID 1048 wrote to memory of 2776 1048 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 33 PID 1048 wrote to memory of 2776 1048 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 33 PID 1048 wrote to memory of 2776 1048 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 33 PID 1048 wrote to memory of 2776 1048 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 33 PID 2776 wrote to memory of 2924 2776 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 34 PID 2776 wrote to memory of 2924 2776 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 34 PID 2776 wrote to memory of 2924 2776 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 34 PID 2776 wrote to memory of 2924 2776 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 34 PID 2924 wrote to memory of 2364 2924 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 35 PID 2924 wrote to memory of 2364 2924 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 35 PID 2924 wrote to memory of 2364 2924 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 35 PID 2924 wrote to memory of 2364 2924 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 35 PID 2364 wrote to memory of 2748 2364 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 36 PID 2364 wrote to memory of 2748 2364 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 36 PID 2364 wrote to memory of 2748 2364 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 36 PID 2364 wrote to memory of 2748 2364 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 36 PID 2748 wrote to memory of 2700 2748 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 37 PID 2748 wrote to memory of 2700 2748 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 37 PID 2748 wrote to memory of 2700 2748 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 37 PID 2748 wrote to memory of 2700 2748 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 37 PID 2700 wrote to memory of 600 2700 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 38 PID 2700 wrote to memory of 600 2700 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 38 PID 2700 wrote to memory of 600 2700 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 38 PID 2700 wrote to memory of 600 2700 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 38 PID 600 wrote to memory of 1976 600 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 39 PID 600 wrote to memory of 1976 600 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 39 PID 600 wrote to memory of 1976 600 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 39 PID 600 wrote to memory of 1976 600 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 39 PID 1976 wrote to memory of 2396 1976 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 40 PID 1976 wrote to memory of 2396 1976 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 40 PID 1976 wrote to memory of 2396 1976 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 40 PID 1976 wrote to memory of 2396 1976 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 40 PID 2396 wrote to memory of 2976 2396 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 41 PID 2396 wrote to memory of 2976 2396 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 41 PID 2396 wrote to memory of 2976 2396 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 41 PID 2396 wrote to memory of 2976 2396 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 41 PID 2976 wrote to memory of 3036 2976 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 42 PID 2976 wrote to memory of 3036 2976 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 42 PID 2976 wrote to memory of 3036 2976 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 42 PID 2976 wrote to memory of 3036 2976 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 42 PID 3036 wrote to memory of 2980 3036 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 43 PID 3036 wrote to memory of 2980 3036 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 43 PID 3036 wrote to memory of 2980 3036 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 43 PID 3036 wrote to memory of 2980 3036 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 43 PID 2980 wrote to memory of 1616 2980 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 44 PID 2980 wrote to memory of 1616 2980 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 44 PID 2980 wrote to memory of 1616 2980 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 44 PID 2980 wrote to memory of 1616 2980 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 44 PID 1616 wrote to memory of 284 1616 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 45 PID 1616 wrote to memory of 284 1616 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 45 PID 1616 wrote to memory of 284 1616 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 45 PID 1616 wrote to memory of 284 1616 3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"9⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"11⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"12⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"13⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"14⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"16⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"17⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"18⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"19⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"20⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"21⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"22⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"23⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"24⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"25⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"26⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"27⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"28⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"29⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"30⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"31⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"32⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"33⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"34⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"35⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"36⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"37⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"38⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"39⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"40⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"41⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"42⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"43⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"44⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"45⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"46⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"47⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"48⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"49⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"50⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"51⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"52⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"53⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"54⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"55⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"56⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"57⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"58⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"59⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"60⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"61⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"62⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"63⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"64⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"65⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"66⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"67⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"68⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"69⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"70⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"71⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"72⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"73⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"74⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"75⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"76⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"77⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"78⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"79⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"80⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"81⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"82⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"83⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"84⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"85⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"86⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"87⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"88⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"89⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"90⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"91⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"92⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"93⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"94⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"95⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"96⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"97⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"98⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"99⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"100⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"101⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"102⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"103⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"104⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"105⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"106⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"107⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"108⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"109⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"110⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"111⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"112⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"113⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"114⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"115⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"116⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"117⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"118⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"119⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"120⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"121⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3355034ba93c64f34a7ff7c218f456f1_JaffaCakes118.exe"122⤵PID:2844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-