Analysis
-
max time kernel
71s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 04:54
Static task
static1
Behavioral task
behavioral1
Sample
58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
58a37ded7d1b1f73f58bd17008e0876f
-
SHA1
a3133b2843899c77f9264689f2a771d3e07f19bd
-
SHA256
a88b51910b9ddaf017d1e1ab39eafdadc3c095aa17ce17dd239e38bdddf0235d
-
SHA512
a8e1d586d4589843a00dd8fd9817054054b82030fb7f5db8a38ba1f1dafd01a70705a30b39497f928e26554b439730483d80a21f3035f68a8cc41be7fd3f2309
-
SSDEEP
12288:g/Aka4d2u1dgjYnYOpbWakQclTVKcXrqI63uL7UpzFxAbz4sS8h8ICxbLqMTDDBW:0AkhHoKtkP4amyezFwS8obRrq
Malware Config
Extracted
nanocore
1.2.2.0
meeti.ddns.net:83
meeti.duckdns.org:83
ae4b70b9-d113-47e0-8b7b-8282a51d736e
-
activate_away_mode
true
-
backup_connection_host
meeti.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2019-07-26T23:46:56.996308236Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
83
-
default_group
A New Eraa
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ae4b70b9-d113-47e0-8b7b-8282a51d736e
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
meeti.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Manager = "C:\\Program Files (x86)\\WPA Manager\\wpamgr.exe" RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exedescription pid process target process PID 1092 set thread context of 3536 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 2036 set thread context of 2684 2036 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3420 set thread context of 636 3420 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4912 set thread context of 3508 4912 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3760 set thread context of 4700 3760 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4768 set thread context of 4140 4768 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3572 set thread context of 4412 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4820 set thread context of 1536 4820 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 1904 set thread context of 3444 1904 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3580 set thread context of 4760 3580 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 552 set thread context of 3660 552 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 1464 set thread context of 4244 1464 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 524 set thread context of 4384 524 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3764 set thread context of 872 3764 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 1156 set thread context of 5012 1156 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3788 set thread context of 3484 3788 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3048 set thread context of 3696 3048 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 976 set thread context of 4632 976 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 4752 set thread context of 4132 4752 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 1432 set thread context of 4976 1432 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3976 set thread context of 2560 3976 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3580 set thread context of 4228 3580 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 1404 set thread context of 3632 1404 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 944 set thread context of 2340 944 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 2692 set thread context of 1636 2692 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 2752 set thread context of 2320 2752 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 1504 set thread context of 3016 1504 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 1460 set thread context of 3508 1460 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4344 set thread context of 2456 4344 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 2452 set thread context of 4424 2452 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4392 set thread context of 2076 4392 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 3260 set thread context of 4676 3260 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 1884 set thread context of 428 1884 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 2684 set thread context of 2732 2684 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 2856 set thread context of 4172 2856 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4700 set thread context of 2324 4700 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 528 set thread context of 3812 528 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4868 set thread context of 212 4868 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 3904 set thread context of 3764 3904 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4632 set thread context of 4544 4632 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 4020 set thread context of 1816 4020 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 680 set thread context of 1904 680 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4140 set thread context of 2976 4140 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 4228 set thread context of 4988 4228 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4772 set thread context of 2336 4772 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 2004 set thread context of 5012 2004 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4636 set thread context of 4500 4636 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 2660 set thread context of 3760 2660 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 2728 set thread context of 4900 2728 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3388 set thread context of 4300 3388 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 768 set thread context of 1744 768 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3608 set thread context of 4772 3608 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 4728 set thread context of 3904 4728 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 2816 set thread context of 2452 2816 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4860 set thread context of 1504 4860 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4700 set thread context of 4884 4700 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 5116 set thread context of 3484 5116 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4364 set thread context of 1020 4364 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 3876 set thread context of 4400 3876 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3580 set thread context of 2692 3580 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4240 set thread context of 1304 4240 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4860 set thread context of 3284 4860 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 392 set thread context of 652 392 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 552 set thread context of 1264 552 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Program Files (x86)\WPA Manager\wpamgr.exe RegAsm.exe File opened for modification C:\Program Files (x86)\WPA Manager\wpamgr.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exepid process 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 3536 RegAsm.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exepid process 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 2036 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 3420 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4912 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4912 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 3760 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 3760 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4768 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4820 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4820 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4820 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1904 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1904 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 3580 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 552 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1464 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 524 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 524 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 3764 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1156 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 3788 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 3048 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 976 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4752 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1432 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1432 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 3976 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 3580 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1404 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 944 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 944 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 2692 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 2692 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 2752 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1504 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1460 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4344 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 2452 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4392 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 3260 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 1884 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 2684 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 2856 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4700 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 528 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 528 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4868 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 3904 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4632 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4020 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4020 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4020 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4020 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 680 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 680 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4140 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4228 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4772 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 2004 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 4636 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exeRegAsm.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3536 RegAsm.exe Token: SeDebugPrivilege 2036 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3420 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4912 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3760 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4768 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4820 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 1904 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3580 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 552 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 1464 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 524 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3764 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 1156 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3788 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3048 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 976 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4752 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 1432 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3976 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3580 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 1404 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 944 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 2692 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 2752 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 1504 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 1460 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4344 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 2452 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4392 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3260 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 1884 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 2684 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 2856 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4700 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 528 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4868 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3904 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4632 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4020 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 680 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4140 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4228 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4772 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 2004 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4636 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 2660 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 2728 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3388 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 768 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3608 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4728 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 2816 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4860 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4700 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 5116 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4364 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3876 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 3580 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4240 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 4860 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe Token: SeDebugPrivilege 392 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exedescription pid process target process PID 1092 wrote to memory of 1128 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 1092 wrote to memory of 1128 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 1092 wrote to memory of 1128 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 1092 wrote to memory of 3536 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 1092 wrote to memory of 3536 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 1092 wrote to memory of 3536 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 1092 wrote to memory of 3536 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 1092 wrote to memory of 2036 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 1092 wrote to memory of 2036 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 1092 wrote to memory of 2036 1092 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 2036 wrote to memory of 2684 2036 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 2036 wrote to memory of 2684 2036 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 2036 wrote to memory of 2684 2036 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 2036 wrote to memory of 2684 2036 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 2036 wrote to memory of 3420 2036 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 2036 wrote to memory of 3420 2036 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 2036 wrote to memory of 3420 2036 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 3420 wrote to memory of 636 3420 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3420 wrote to memory of 636 3420 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3420 wrote to memory of 636 3420 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3420 wrote to memory of 636 3420 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3420 wrote to memory of 4912 3420 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 3420 wrote to memory of 4912 3420 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 3420 wrote to memory of 4912 3420 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 4912 wrote to memory of 4764 4912 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4912 wrote to memory of 4764 4912 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4912 wrote to memory of 4764 4912 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4912 wrote to memory of 3508 4912 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4912 wrote to memory of 3508 4912 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4912 wrote to memory of 3508 4912 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4912 wrote to memory of 3508 4912 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4912 wrote to memory of 3760 4912 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 4912 wrote to memory of 3760 4912 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 4912 wrote to memory of 3760 4912 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 3760 wrote to memory of 3484 3760 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3760 wrote to memory of 3484 3760 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3760 wrote to memory of 3484 3760 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3760 wrote to memory of 4700 3760 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3760 wrote to memory of 4700 3760 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3760 wrote to memory of 4700 3760 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3760 wrote to memory of 4700 3760 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3760 wrote to memory of 4768 3760 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 3760 wrote to memory of 4768 3760 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 3760 wrote to memory of 4768 3760 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 4768 wrote to memory of 4140 4768 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4768 wrote to memory of 4140 4768 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4768 wrote to memory of 4140 4768 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4768 wrote to memory of 4140 4768 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 4768 wrote to memory of 3572 4768 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 4768 wrote to memory of 3572 4768 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 4768 wrote to memory of 3572 4768 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 3572 wrote to memory of 3892 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3572 wrote to memory of 3892 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3572 wrote to memory of 3892 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3572 wrote to memory of 508 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3572 wrote to memory of 508 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3572 wrote to memory of 508 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3572 wrote to memory of 4412 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3572 wrote to memory of 4412 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3572 wrote to memory of 4412 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3572 wrote to memory of 4412 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe RegAsm.exe PID 3572 wrote to memory of 4820 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 3572 wrote to memory of 4820 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe PID 3572 wrote to memory of 4820 3572 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe 58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"5⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"8⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"9⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"10⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"12⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"13⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"14⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"15⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"16⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"17⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"18⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"19⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"20⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"21⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"22⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"23⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"24⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"25⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"26⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"27⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"28⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"29⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"30⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"31⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"32⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"33⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"34⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"35⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"36⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"37⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"38⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"39⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"40⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"41⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"42⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"43⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"44⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"45⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"46⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"47⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"48⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"49⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"50⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"51⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"52⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"53⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"54⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"55⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"56⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"57⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"58⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"59⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"60⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"61⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"62⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"63⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"64⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"65⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"66⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"67⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"68⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"69⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"70⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"71⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"72⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"73⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"74⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"75⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"76⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"77⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"78⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"79⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"80⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"81⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"82⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"83⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"84⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"85⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"86⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"87⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"89⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"90⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"91⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"92⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"92⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"93⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"94⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"94⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"94⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"95⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"96⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"97⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"98⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"99⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"101⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"102⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"103⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"104⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"105⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"106⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"107⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"108⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"108⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"109⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"110⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"111⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"112⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"113⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"113⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"113⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"114⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"114⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"115⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"116⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"117⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"118⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"119⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"120⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"121⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"121⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"123⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"123⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"124⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"124⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"125⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"125⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"125⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"125⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"126⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"126⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"127⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"127⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"128⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"130⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"130⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"131⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"131⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"132⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"132⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"133⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"133⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"133⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"134⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"134⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"135⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"137⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"137⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"138⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"138⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"139⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"139⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"140⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"140⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"141⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"141⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"142⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"142⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"143⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"143⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"143⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"143⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"144⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"145⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"145⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"146⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"146⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"147⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"147⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"148⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"148⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"149⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"149⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"150⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"150⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"150⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"151⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"151⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"152⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"152⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"153⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"153⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"154⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"154⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"154⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"154⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"155⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"155⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"156⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"156⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"157⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"157⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"157⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"158⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"158⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"158⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"159⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"159⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"160⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"160⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"160⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"160⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"161⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"161⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"162⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"162⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"163⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"163⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"164⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"164⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"164⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"164⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"165⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"165⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"166⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"166⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"167⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"167⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"167⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"167⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"168⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"168⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"168⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"169⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"169⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"170⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"170⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"171⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"171⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"172⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"172⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"173⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"173⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"174⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"174⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"175⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"175⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"176⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"176⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"176⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"176⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"176⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"177⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"177⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"178⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"178⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"179⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"179⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"180⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"180⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"181⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"181⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"182⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"182⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"183⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"183⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"183⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"184⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"184⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"185⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"185⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"185⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"185⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"186⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"186⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"187⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"187⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"188⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"188⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"189⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"189⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"189⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"190⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"190⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"191⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"191⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"192⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"192⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"193⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"193⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"193⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"194⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"194⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"194⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"194⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"195⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"195⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"196⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"196⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"197⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"197⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"197⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"197⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"198⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"198⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"199⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"199⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"199⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"200⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"200⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"201⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"201⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"202⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"202⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"203⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"203⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"204⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"204⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"205⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"205⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"206⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"206⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"207⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"207⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"207⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"207⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"207⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"208⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"208⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"208⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"209⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"209⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"210⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"210⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"211⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"211⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"212⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"212⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"213⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"213⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"214⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"214⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"215⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"215⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"216⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"216⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"216⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"217⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"217⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"218⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"218⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"219⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"219⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"220⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"220⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"221⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"221⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"221⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"222⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"222⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"223⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"223⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"224⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"224⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"225⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"225⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"226⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"226⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"227⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"227⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"228⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"228⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"228⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"229⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"229⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"230⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"230⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"231⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"231⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"232⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"232⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"232⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"233⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"233⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"234⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"234⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"234⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"235⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"235⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"236⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"236⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"236⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"237⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"237⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"238⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"238⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"239⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"239⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"240⤵
-
C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"240⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"241⤵