Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 22:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe
Resource
win7-20240705-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe
Resource
win10v2004-20240709-en
3 signatures
150 seconds
General
-
Target
650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe
-
Size
344KB
-
MD5
650f0e5209db980ab4289562137a4b12
-
SHA1
94688db79c4327a6007b93ff9125f968fe34797e
-
SHA256
7b6e1b4bbd611e5a912023fba857710927d750b66ed44b7878f84c6f4590c5e0
-
SHA512
29df121cb1c80d7146b037c2789d35c3dbef04cee2242c32b14d7461786088252a3fbcab24da5eb0ad12d5aabb544ba7f8bca0834e6d86d3a9d274fe4129163b
-
SSDEEP
3072:kZ6bxLWgy0FatjuJ6KjJrDmoq59nBcX1oegrJVa:koFLWgBstaJfjJrDmtcFJgrJw
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 2352 set thread context of 1028 2352 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 30 PID 1028 set thread context of 2408 1028 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 31 PID 2408 set thread context of 1296 2408 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 32 PID 1296 set thread context of 2544 1296 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 33 PID 2544 set thread context of 2728 2544 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 34 PID 2728 set thread context of 2992 2728 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 35 PID 2992 set thread context of 2340 2992 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 36 PID 2340 set thread context of 2896 2340 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 37 PID 2896 set thread context of 2656 2896 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 38 PID 2656 set thread context of 2360 2656 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 39 PID 2360 set thread context of 2648 2360 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 40 PID 2648 set thread context of 3060 2648 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 41 PID 3060 set thread context of 2792 3060 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 42 PID 2792 set thread context of 860 2792 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 43 PID 860 set thread context of 1044 860 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 44 PID 1044 set thread context of 1228 1044 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 45 PID 1228 set thread context of 2224 1228 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 46 PID 2224 set thread context of 1592 2224 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 47 PID 1592 set thread context of 2056 1592 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 48 PID 2056 set thread context of 2932 2056 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 49 PID 2932 set thread context of 2316 2932 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 50 PID 2316 set thread context of 2004 2316 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 51 PID 2004 set thread context of 2016 2004 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 52 PID 2016 set thread context of 1900 2016 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 53 PID 1900 set thread context of 2100 1900 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 54 PID 2100 set thread context of 2064 2100 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 55 PID 2064 set thread context of 264 2064 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 56 PID 264 set thread context of 1072 264 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 57 PID 1072 set thread context of 3008 1072 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 58 PID 3008 set thread context of 1628 3008 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 59 PID 1628 set thread context of 408 1628 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 60 PID 408 set thread context of 2324 408 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 61 PID 2324 set thread context of 1968 2324 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 62 PID 1968 set thread context of 1556 1968 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 63 PID 1556 set thread context of 3052 1556 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 64 PID 3052 set thread context of 1824 3052 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 65 PID 1824 set thread context of 1636 1824 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 66 PID 1636 set thread context of 1004 1636 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 67 PID 1004 set thread context of 2264 1004 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 68 PID 2264 set thread context of 2440 2264 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 69 PID 2440 set thread context of 1460 2440 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 70 PID 1460 set thread context of 2312 1460 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 71 PID 2312 set thread context of 2428 2312 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 72 PID 2428 set thread context of 1548 2428 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 73 PID 1548 set thread context of 2532 1548 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 74 PID 2532 set thread context of 2240 2532 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 75 PID 1648 set thread context of 2384 1648 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 77 PID 2384 set thread context of 1124 2384 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 78 PID 1124 set thread context of 2092 1124 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 79 PID 2092 set thread context of 2448 2092 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 80 PID 2448 set thread context of 2808 2448 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 81 PID 2808 set thread context of 2848 2808 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 82 PID 2848 set thread context of 2888 2848 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 83 PID 2888 set thread context of 2780 2888 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 84 PID 2780 set thread context of 2640 2780 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 85 PID 2640 set thread context of 2664 2640 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 86 PID 2664 set thread context of 2632 2664 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 87 PID 2632 set thread context of 2668 2632 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 88 PID 2668 set thread context of 2512 2668 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 89 PID 2512 set thread context of 2864 2512 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 90 PID 2864 set thread context of 1496 2864 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 91 PID 1496 set thread context of 2108 1496 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 92 PID 2108 set thread context of 2868 2108 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 93 PID 2868 set thread context of 2084 2868 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 94 -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2352 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1028 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2408 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1296 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2544 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2728 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2992 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2340 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2896 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2656 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2360 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2648 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 3060 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2792 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 860 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1044 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1228 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2224 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1592 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2056 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2932 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2316 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2004 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2016 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1900 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2100 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2064 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 264 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1072 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 3008 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1628 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 408 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2324 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1968 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1556 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 3052 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1824 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1636 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1004 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2264 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2440 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1460 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2312 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2428 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1548 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2532 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1648 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2384 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1124 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2092 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2448 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2808 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2848 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2888 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2780 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2640 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2664 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2632 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2668 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2512 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2864 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 1496 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2108 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 2868 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 1028 2352 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 30 PID 2352 wrote to memory of 1028 2352 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 30 PID 2352 wrote to memory of 1028 2352 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 30 PID 2352 wrote to memory of 1028 2352 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 30 PID 2352 wrote to memory of 1028 2352 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 30 PID 2352 wrote to memory of 1028 2352 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 30 PID 2352 wrote to memory of 1028 2352 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 30 PID 2352 wrote to memory of 1028 2352 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 30 PID 2352 wrote to memory of 1028 2352 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 30 PID 2352 wrote to memory of 1028 2352 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 30 PID 1028 wrote to memory of 2408 1028 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 31 PID 1028 wrote to memory of 2408 1028 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 31 PID 1028 wrote to memory of 2408 1028 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 31 PID 1028 wrote to memory of 2408 1028 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 31 PID 1028 wrote to memory of 2408 1028 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 31 PID 1028 wrote to memory of 2408 1028 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 31 PID 1028 wrote to memory of 2408 1028 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 31 PID 1028 wrote to memory of 2408 1028 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 31 PID 1028 wrote to memory of 2408 1028 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 31 PID 1028 wrote to memory of 2408 1028 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 31 PID 2408 wrote to memory of 1296 2408 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 32 PID 2408 wrote to memory of 1296 2408 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 32 PID 2408 wrote to memory of 1296 2408 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 32 PID 2408 wrote to memory of 1296 2408 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 32 PID 2408 wrote to memory of 1296 2408 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 32 PID 2408 wrote to memory of 1296 2408 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 32 PID 2408 wrote to memory of 1296 2408 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 32 PID 2408 wrote to memory of 1296 2408 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 32 PID 2408 wrote to memory of 1296 2408 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 32 PID 2408 wrote to memory of 1296 2408 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 32 PID 1296 wrote to memory of 2544 1296 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 33 PID 1296 wrote to memory of 2544 1296 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 33 PID 1296 wrote to memory of 2544 1296 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 33 PID 1296 wrote to memory of 2544 1296 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 33 PID 1296 wrote to memory of 2544 1296 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 33 PID 1296 wrote to memory of 2544 1296 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 33 PID 1296 wrote to memory of 2544 1296 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 33 PID 1296 wrote to memory of 2544 1296 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 33 PID 1296 wrote to memory of 2544 1296 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 33 PID 1296 wrote to memory of 2544 1296 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 33 PID 2544 wrote to memory of 2728 2544 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 34 PID 2544 wrote to memory of 2728 2544 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 34 PID 2544 wrote to memory of 2728 2544 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 34 PID 2544 wrote to memory of 2728 2544 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 34 PID 2544 wrote to memory of 2728 2544 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 34 PID 2544 wrote to memory of 2728 2544 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 34 PID 2544 wrote to memory of 2728 2544 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 34 PID 2544 wrote to memory of 2728 2544 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 34 PID 2544 wrote to memory of 2728 2544 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 34 PID 2544 wrote to memory of 2728 2544 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 34 PID 2728 wrote to memory of 2992 2728 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 35 PID 2728 wrote to memory of 2992 2728 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 35 PID 2728 wrote to memory of 2992 2728 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 35 PID 2728 wrote to memory of 2992 2728 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 35 PID 2728 wrote to memory of 2992 2728 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 35 PID 2728 wrote to memory of 2992 2728 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 35 PID 2728 wrote to memory of 2992 2728 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 35 PID 2728 wrote to memory of 2992 2728 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 35 PID 2728 wrote to memory of 2992 2728 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 35 PID 2728 wrote to memory of 2992 2728 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 35 PID 2992 wrote to memory of 2340 2992 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 36 PID 2992 wrote to memory of 2340 2992 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 36 PID 2992 wrote to memory of 2340 2992 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 36 PID 2992 wrote to memory of 2340 2992 650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"8⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"9⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"10⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"12⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"13⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"14⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"15⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:860 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"16⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"17⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"18⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"19⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"20⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"21⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"22⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"23⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"24⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"25⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"26⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"27⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"28⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:264 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"29⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"30⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"31⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"32⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:408 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"33⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"34⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"35⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"36⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"37⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"38⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"39⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"40⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"41⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"42⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"43⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"44⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"45⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"46⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"47⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"48⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"49⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"50⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"51⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"52⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"53⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"54⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"55⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"56⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"57⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"58⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"59⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"60⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"61⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"62⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"63⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"64⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"65⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"66⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"67⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"68⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"69⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"70⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"71⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"72⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"73⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"74⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"75⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"76⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"77⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"78⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"79⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"80⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"81⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"82⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"83⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"84⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"85⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"86⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"87⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"88⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"89⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"90⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"91⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"92⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"93⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"94⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"95⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"96⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"97⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"98⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"99⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"100⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"101⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"102⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"103⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"104⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"105⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"106⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"107⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"108⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"109⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"110⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"111⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"112⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"113⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"114⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"115⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"116⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"117⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"118⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"119⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"120⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"121⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\650f0e5209db980ab4289562137a4b12_JaffaCakes118.exe"122⤵PID:1804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-