Analysis
-
max time kernel
64s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 20:57
Static task
static1
Behavioral task
behavioral1
Sample
3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
3c08f6f4822e6db8251c8aeb87674229
-
SHA1
2cdb2b28f64dd2986cc293344a3c449f28d7c7a8
-
SHA256
cd1de2640e4fb5b66ca8b02fe6340d8c2111cb44092a1dd86d6c467456dd7716
-
SHA512
f70046e9da9c26908811feccd8316eefb5a51c0b9438d38e8766a625bda41c7acaa722bb2ea66d0398bb19bb642916dcae7abb7edd785bcedb4d9be672f441a9
-
SSDEEP
24576:ItNAxLvHp5/ZX3RtVidNOwCT7FGeAfd844UHu38bGRfSNQJvQvBLgT6WoI2ii/9Q:INI+56QD
Malware Config
Extracted
nanocore
1.2.2.0
79.134.225.106:2110
038bbe7d-bb0f-4e39-acc0-328059e1f435
-
activate_away_mode
true
-
backup_connection_host
79.134.225.106
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2019-08-12T05:17:21.810663436Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2110
-
default_group
test
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
038bbe7d-bb0f-4e39-acc0-328059e1f435
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
79.134.225.106
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Subsystem = "C:\\Program Files (x86)\\DPI Subsystem\\dpiss.exe" RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exedescription pid process target process PID 1184 set thread context of 4132 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1400 set thread context of 3132 1400 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1084 set thread context of 1352 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1216 set thread context of 1148 1216 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1564 set thread context of 968 1564 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4512 set thread context of 1936 4512 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2440 set thread context of 1924 2440 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1860 set thread context of 3960 1860 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 3108 set thread context of 4852 3108 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4204 set thread context of 392 4204 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 3988 set thread context of 3228 3988 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 3536 set thread context of 4732 3536 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4768 set thread context of 3580 4768 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 3124 set thread context of 2388 3124 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4300 set thread context of 4564 4300 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1776 set thread context of 4552 1776 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4308 set thread context of 3336 4308 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2156 set thread context of 4908 2156 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2444 set thread context of 3404 2444 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 3732 set thread context of 4980 3732 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2520 set thread context of 1860 2520 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4064 set thread context of 4036 4064 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2804 set thread context of 3116 2804 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2636 set thread context of 4448 2636 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1844 set thread context of 536 1844 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4300 set thread context of 3572 4300 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1624 set thread context of 4612 1624 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2272 set thread context of 4516 2272 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 460 set thread context of 2444 460 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 3052 set thread context of 624 3052 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4848 set thread context of 816 4848 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2108 set thread context of 2232 2108 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4064 set thread context of 4400 4064 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 3960 set thread context of 2732 3960 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2744 set thread context of 3460 2744 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 3684 set thread context of 1716 3684 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4828 set thread context of 4736 4828 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 3268 set thread context of 4360 3268 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4884 set thread context of 3568 4884 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2692 set thread context of 3764 2692 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4712 set thread context of 4476 4712 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4508 set thread context of 3424 4508 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1684 set thread context of 2096 1684 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4064 set thread context of 2728 4064 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4728 set thread context of 1104 4728 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1152 set thread context of 232 1152 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 3780 set thread context of 4680 3780 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4732 set thread context of 3388 4732 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1564 set thread context of 4884 1564 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 460 set thread context of 4552 460 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4456 set thread context of 436 4456 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1632 set thread context of 1396 1632 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1084 set thread context of 3920 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4444 set thread context of 5104 4444 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4292 set thread context of 3748 4292 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4272 set thread context of 4436 4272 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 752 set thread context of 4728 752 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 3408 set thread context of 4036 3408 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 228 set thread context of 2672 228 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 3096 set thread context of 1064 3096 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 432 set thread context of 4668 432 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1564 set thread context of 2092 1564 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2804 set thread context of 4820 2804 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 3244 set thread context of 936 3244 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Program Files (x86)\DPI Subsystem\dpiss.exe RegAsm.exe File opened for modification C:\Program Files (x86)\DPI Subsystem\dpiss.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exepid process 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 4132 RegAsm.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exepid process 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1400 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1216 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1564 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4512 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 2440 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1860 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1860 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3108 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4204 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4204 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3988 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3536 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3536 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3536 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3536 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4768 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4768 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3124 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4300 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1776 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4308 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4308 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4308 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 2156 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 2156 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 2444 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 2444 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3732 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 2520 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4064 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 2804 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 2636 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1844 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4300 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1624 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 2272 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 460 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3052 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4848 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4848 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 2108 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4064 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3960 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 2744 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3684 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3684 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4828 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3268 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4884 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 2692 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 2692 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4712 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4508 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1684 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4064 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4064 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4064 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4064 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 4728 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1152 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 1152 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exeRegAsm.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4132 RegAsm.exe Token: SeDebugPrivilege 1400 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 1216 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 1564 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4512 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 2440 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 1860 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 3108 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4204 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 3988 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 3536 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4768 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 3124 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4300 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 1776 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4308 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 2156 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 2444 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 3732 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 2520 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4064 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 2804 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 2636 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 1844 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4300 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 1624 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 2272 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 460 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 3052 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4848 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 2108 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4064 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 3960 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 2744 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 3684 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4828 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 3268 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4884 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 2692 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4712 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4508 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 1684 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4064 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4728 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 1152 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 3780 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4732 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 1564 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 460 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4456 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 1632 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4444 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4292 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 4272 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 752 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 3408 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 228 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 3096 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 432 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 1564 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe Token: SeDebugPrivilege 2804 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exedescription pid process target process PID 1184 wrote to memory of 4132 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1184 wrote to memory of 4132 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1184 wrote to memory of 4132 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1184 wrote to memory of 4132 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1184 wrote to memory of 1400 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1184 wrote to memory of 1400 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1184 wrote to memory of 1400 1184 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1400 wrote to memory of 3132 1400 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1400 wrote to memory of 3132 1400 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1400 wrote to memory of 3132 1400 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1400 wrote to memory of 3132 1400 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1400 wrote to memory of 1084 1400 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1400 wrote to memory of 1084 1400 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1400 wrote to memory of 1084 1400 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1084 wrote to memory of 2152 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1084 wrote to memory of 2152 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1084 wrote to memory of 2152 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1084 wrote to memory of 1352 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1084 wrote to memory of 1352 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1084 wrote to memory of 1352 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1084 wrote to memory of 1352 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1084 wrote to memory of 1216 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1084 wrote to memory of 1216 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1084 wrote to memory of 1216 1084 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1216 wrote to memory of 1148 1216 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1216 wrote to memory of 1148 1216 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1216 wrote to memory of 1148 1216 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1216 wrote to memory of 1148 1216 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1216 wrote to memory of 1564 1216 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1216 wrote to memory of 1564 1216 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1216 wrote to memory of 1564 1216 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1564 wrote to memory of 968 1564 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1564 wrote to memory of 968 1564 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1564 wrote to memory of 968 1564 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1564 wrote to memory of 968 1564 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1564 wrote to memory of 4512 1564 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1564 wrote to memory of 4512 1564 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1564 wrote to memory of 4512 1564 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 4512 wrote to memory of 1936 4512 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4512 wrote to memory of 1936 4512 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4512 wrote to memory of 1936 4512 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4512 wrote to memory of 1936 4512 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 4512 wrote to memory of 2440 4512 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 4512 wrote to memory of 2440 4512 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 4512 wrote to memory of 2440 4512 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 2440 wrote to memory of 1924 2440 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2440 wrote to memory of 1924 2440 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2440 wrote to memory of 1924 2440 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2440 wrote to memory of 1924 2440 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2440 wrote to memory of 1860 2440 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2440 wrote to memory of 1860 2440 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 2440 wrote to memory of 1860 2440 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1860 wrote to memory of 4752 1860 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1860 wrote to memory of 4752 1860 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1860 wrote to memory of 4752 1860 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1860 wrote to memory of 3960 1860 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1860 wrote to memory of 3960 1860 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1860 wrote to memory of 3960 1860 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1860 wrote to memory of 3960 1860 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 1860 wrote to memory of 3108 1860 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1860 wrote to memory of 3108 1860 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 1860 wrote to memory of 3108 1860 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe PID 3108 wrote to memory of 4852 3108 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe PID 3108 wrote to memory of 4852 3108 3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"8⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"9⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"10⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"12⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"13⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"14⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"15⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"16⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"17⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"18⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"19⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"20⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"21⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"22⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"23⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"24⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"25⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"26⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"27⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"28⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"29⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"30⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"31⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"32⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"33⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"34⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"35⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"36⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"37⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"38⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"39⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"40⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"41⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"42⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"43⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"44⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"45⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"46⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"47⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"48⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"49⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"50⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"51⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"52⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"53⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"54⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"55⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"56⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"57⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"58⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"59⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"60⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"61⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"62⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"63⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"64⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"65⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"66⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"67⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"68⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"69⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"70⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"71⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"72⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"73⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"74⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"75⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"76⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"78⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"79⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"80⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"81⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"82⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"83⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"84⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"85⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"86⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"87⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"89⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"90⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"91⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"92⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"93⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"94⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"96⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"97⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"98⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"99⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"101⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"102⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"103⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"104⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"105⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"106⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"107⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"108⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"109⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"110⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"111⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"112⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"113⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"114⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"115⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"116⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"117⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"118⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"119⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"120⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"121⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"121⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"121⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"122⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"123⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"124⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"124⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"125⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"125⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"126⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"126⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"127⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"127⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"128⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"130⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"130⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"131⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"132⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"132⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"133⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"134⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"134⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"134⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"134⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"134⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"137⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"137⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"138⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"138⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"139⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"139⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"140⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"140⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"141⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"142⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"142⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"143⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"143⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"144⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"145⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"145⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"145⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"145⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"146⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"146⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"146⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"146⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"147⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"147⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"148⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"148⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"148⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"148⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"148⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"148⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"148⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"149⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"149⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"150⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"150⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"151⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"151⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"152⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"152⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"152⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"153⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"153⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"153⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"154⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"154⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"155⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"156⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"156⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"157⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"158⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"158⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"159⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"160⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"160⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"161⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"161⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"162⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"162⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"163⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"163⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"164⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"164⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"165⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"166⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"166⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"167⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"168⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"168⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"169⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"170⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"170⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"170⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"171⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"172⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"172⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"173⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"173⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"174⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"174⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"175⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"175⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"175⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"175⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"176⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"176⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"176⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"177⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"177⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"178⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"178⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"179⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"180⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"180⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"181⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"182⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"182⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"183⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"183⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"183⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"184⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"184⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"185⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"185⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"186⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"186⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"186⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"186⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"186⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"186⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"187⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"187⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"188⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"188⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"189⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"190⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"190⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"191⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"191⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"192⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"192⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"193⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"193⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"193⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"194⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"194⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"195⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"195⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"196⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"196⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"197⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"197⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"198⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"198⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"199⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"199⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"199⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"200⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"200⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"201⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"201⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"201⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"202⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"202⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"203⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"204⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"204⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"204⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"205⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"206⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"206⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"206⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"207⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"207⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"208⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"208⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"208⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"209⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"210⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"210⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"211⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"211⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"212⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"212⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"213⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"213⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"214⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"214⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"215⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"215⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"216⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"216⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"217⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"217⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"217⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"218⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"218⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"219⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"219⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"220⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"220⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"221⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"221⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"222⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"222⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"223⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"223⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"224⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"224⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"225⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"226⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"226⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"226⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"227⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"228⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"228⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"229⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"230⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"230⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"231⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"231⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"232⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"232⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"233⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"234⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"234⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"235⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"235⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"236⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"236⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"237⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"237⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"237⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"238⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"238⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"239⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"240⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"240⤵
-
C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c08f6f4822e6db8251c8aeb87674229_JaffaCakes118.exe"240⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"241⤵