Analysis
-
max time kernel
69s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 05:26
Static task
static1
Behavioral task
behavioral1
Sample
5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
5d6504033e0108dd331c3514c9b92772
-
SHA1
94f3653d419813a95af7174937181321dbfa25f4
-
SHA256
3798eda97eb1c96e59e379d952389a01dd6e753563c367f4cad3673b0703b0b5
-
SHA512
3d8ebfd92055007eeb865b64482656d29ceda7d9cdfc0495c62bc0b3f481697dbf37873a11187838d6ff78c2fe4600cd0dbbbd3e110d8899875cdcecc53a2156
-
SSDEEP
24576:uQ1Rl5jC806M2DYTcSX1ZajRg//3uno46+DThVrMAY0wLQqd/tUTjFYaCtjZZwaG:u85jChzcJ1LGDWHahjfS
Malware Config
Extracted
nanocore
1.2.2.0
meeti.ddns.net:83
meeti.duckdns.org:83
ae4b70b9-d113-47e0-8b7b-8282a51d736e
-
activate_away_mode
true
-
backup_connection_host
meeti.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2019-07-26T23:46:56.996308236Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
83
-
default_group
A New Eraa
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ae4b70b9-d113-47e0-8b7b-8282a51d736e
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
meeti.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Service = "C:\\Program Files (x86)\\DHCP Service\\dhcpsv.exe" RegAsm.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 4960 set thread context of 4528 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 82 PID 1584 set thread context of 3692 1584 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 86 PID 5012 set thread context of 2540 5012 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 90 PID 2680 set thread context of 1404 2680 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 92 PID 3216 set thread context of 4948 3216 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 94 PID 3252 set thread context of 4384 3252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 96 PID 224 set thread context of 2696 224 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 98 PID 708 set thread context of 4936 708 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 100 PID 3200 set thread context of 1496 3200 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 102 PID 2304 set thread context of 4900 2304 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 104 PID 3928 set thread context of 1256 3928 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 106 PID 4564 set thread context of 4072 4564 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 169 PID 2844 set thread context of 1840 2844 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 110 PID 4128 set thread context of 4812 4128 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 173 PID 2556 set thread context of 3256 2556 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 117 PID 632 set thread context of 1640 632 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 194 PID 3844 set thread context of 4904 3844 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 123 PID 4468 set thread context of 3616 4468 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 127 PID 3348 set thread context of 392 3348 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 129 PID 3204 set thread context of 4716 3204 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 131 PID 3416 set thread context of 2840 3416 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 133 PID 1428 set thread context of 2312 1428 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 232 PID 2552 set thread context of 3496 2552 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 138 PID 4156 set thread context of 3024 4156 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 199 PID 3196 set thread context of 940 3196 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 148 PID 4468 set thread context of 4476 4468 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 152 PID 4256 set thread context of 3864 4256 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 154 PID 3592 set thread context of 4044 3592 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 229 PID 5116 set thread context of 4564 5116 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 159 PID 4572 set thread context of 3584 4572 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 217 PID 3780 set thread context of 768 3780 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 164 PID 4692 set thread context of 2276 4692 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 166 PID 4252 set thread context of 4072 4252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 169 PID 2668 set thread context of 4468 2668 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 275 PID 3204 set thread context of 4812 3204 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 173 PID 2956 set thread context of 3688 2956 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 175 PID 5116 set thread context of 2036 5116 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 180 PID 3964 set thread context of 4004 3964 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 183 PID 3252 set thread context of 2332 3252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 186 PID 4384 set thread context of 3908 4384 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 299 PID 4080 set thread context of 3312 4080 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 191 PID 4600 set thread context of 1640 4600 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 194 PID 744 set thread context of 588 744 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 196 PID 3068 set thread context of 4076 3068 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 326 PID 3024 set thread context of 428 3024 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 317 PID 1240 set thread context of 4884 1240 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 205 PID 2668 set thread context of 2952 2668 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 315 PID 3060 set thread context of 1500 3060 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 210 PID 4332 set thread context of 216 4332 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 214 PID 1428 set thread context of 2540 1428 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 311 PID 3584 set thread context of 2860 3584 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 218 PID 1184 set thread context of 3068 1184 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 363 PID 4912 set thread context of 2552 4912 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 271 PID 1392 set thread context of 4412 1392 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 224 PID 652 set thread context of 2468 652 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 226 PID 4244 set thread context of 3432 4244 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 399 PID 4044 set thread context of 3200 4044 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 231 PID 2312 set thread context of 2128 2312 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 233 PID 4716 set thread context of 3684 4716 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 292 PID 3508 set thread context of 4444 3508 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 237 PID 4320 set thread context of 4920 4320 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 239 PID 4436 set thread context of 5044 4436 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 301 PID 1628 set thread context of 844 1628 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 244 PID 4408 set thread context of 4888 4408 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 246 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\DHCP Service\dhcpsv.exe RegAsm.exe File opened for modification C:\Program Files (x86)\DHCP Service\dhcpsv.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4528 RegAsm.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 1584 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 5012 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 5012 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 2680 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3216 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 224 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 708 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3200 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 2304 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3928 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4564 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 2844 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4128 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4128 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 2556 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 632 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 632 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3844 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4468 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4468 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3348 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3204 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3416 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 1428 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 2552 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4156 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4156 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3196 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3196 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3196 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3196 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4468 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4468 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4468 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4256 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3592 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 5116 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 5116 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4572 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4572 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3780 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4692 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 2668 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3204 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 2956 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 5116 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 5116 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 5116 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3964 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3964 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4384 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4080 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4080 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 4600 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 744 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3068 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3024 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3024 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 3024 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4528 RegAsm.exe Token: SeDebugPrivilege 1584 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 5012 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 2680 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3216 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 224 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 708 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3200 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 2304 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3928 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4564 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 2844 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4128 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 2556 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 632 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3844 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4468 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3348 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3204 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3416 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 1428 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 2552 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4156 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3196 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4468 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4256 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3592 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 5116 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4572 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3780 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4692 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 2668 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3204 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 2956 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 5116 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3964 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4384 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4080 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4600 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 744 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3068 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3024 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 1240 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 2668 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3060 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4332 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 1428 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3584 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 1184 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4912 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 1392 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 652 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4244 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4044 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 2312 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4716 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 3508 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4320 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 4436 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe Token: SeDebugPrivilege 1628 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4960 wrote to memory of 4528 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 82 PID 4960 wrote to memory of 4528 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 82 PID 4960 wrote to memory of 4528 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 82 PID 4960 wrote to memory of 4528 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 82 PID 4960 wrote to memory of 1584 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 85 PID 4960 wrote to memory of 1584 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 85 PID 4960 wrote to memory of 1584 4960 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 85 PID 1584 wrote to memory of 3692 1584 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 86 PID 1584 wrote to memory of 3692 1584 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 86 PID 1584 wrote to memory of 3692 1584 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 86 PID 1584 wrote to memory of 3692 1584 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 86 PID 1584 wrote to memory of 5012 1584 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 88 PID 1584 wrote to memory of 5012 1584 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 88 PID 1584 wrote to memory of 5012 1584 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 88 PID 5012 wrote to memory of 2244 5012 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 89 PID 5012 wrote to memory of 2244 5012 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 89 PID 5012 wrote to memory of 2244 5012 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 89 PID 5012 wrote to memory of 2540 5012 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 90 PID 5012 wrote to memory of 2540 5012 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 90 PID 5012 wrote to memory of 2540 5012 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 90 PID 5012 wrote to memory of 2540 5012 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 90 PID 5012 wrote to memory of 2680 5012 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 91 PID 5012 wrote to memory of 2680 5012 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 91 PID 5012 wrote to memory of 2680 5012 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 91 PID 2680 wrote to memory of 1404 2680 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 92 PID 2680 wrote to memory of 1404 2680 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 92 PID 2680 wrote to memory of 1404 2680 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 92 PID 2680 wrote to memory of 1404 2680 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 92 PID 2680 wrote to memory of 3216 2680 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 93 PID 2680 wrote to memory of 3216 2680 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 93 PID 2680 wrote to memory of 3216 2680 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 93 PID 3216 wrote to memory of 4948 3216 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 94 PID 3216 wrote to memory of 4948 3216 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 94 PID 3216 wrote to memory of 4948 3216 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 94 PID 3216 wrote to memory of 4948 3216 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 94 PID 3216 wrote to memory of 3252 3216 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 95 PID 3216 wrote to memory of 3252 3216 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 95 PID 3216 wrote to memory of 3252 3216 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 95 PID 3252 wrote to memory of 4384 3252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 96 PID 3252 wrote to memory of 4384 3252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 96 PID 3252 wrote to memory of 4384 3252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 96 PID 3252 wrote to memory of 4384 3252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 96 PID 3252 wrote to memory of 224 3252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 97 PID 3252 wrote to memory of 224 3252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 97 PID 3252 wrote to memory of 224 3252 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 97 PID 224 wrote to memory of 2696 224 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 98 PID 224 wrote to memory of 2696 224 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 98 PID 224 wrote to memory of 2696 224 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 98 PID 224 wrote to memory of 2696 224 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 98 PID 224 wrote to memory of 708 224 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 99 PID 224 wrote to memory of 708 224 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 99 PID 224 wrote to memory of 708 224 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 99 PID 708 wrote to memory of 4936 708 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 100 PID 708 wrote to memory of 4936 708 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 100 PID 708 wrote to memory of 4936 708 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 100 PID 708 wrote to memory of 4936 708 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 100 PID 708 wrote to memory of 3200 708 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 101 PID 708 wrote to memory of 3200 708 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 101 PID 708 wrote to memory of 3200 708 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 101 PID 3200 wrote to memory of 1496 3200 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 102 PID 3200 wrote to memory of 1496 3200 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 102 PID 3200 wrote to memory of 1496 3200 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 102 PID 3200 wrote to memory of 1496 3200 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 102 PID 3200 wrote to memory of 2304 3200 5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4528
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:3692
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:2244
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:2540
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"4⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵PID:1404
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵PID:4948
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵PID:4384
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"7⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"8⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵PID:4936
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"9⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵PID:1496
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"10⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2304 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵PID:4900
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3928 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵PID:1256
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4564 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵PID:4072
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"13⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2844 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵PID:1840
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"14⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4128 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵PID:3264
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵PID:4812
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"15⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2556 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵PID:3256
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"16⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:632 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵PID:2196
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵PID:1640
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"17⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3844 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵PID:4904
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"18⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4468 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵PID:2132
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵PID:3616
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"19⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3348 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵PID:392
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"20⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3204 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵PID:4716
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"21⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3416 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"22⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1428 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵PID:2312
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"23⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2552 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵PID:3496
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"24⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4156 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵PID:3772
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵PID:3024
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"25⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3196 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵PID:1528
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵PID:3844
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵PID:4076
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵PID:940
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"26⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4468 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵PID:2616
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵PID:4948
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵PID:4476
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"27⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4256 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵PID:3864
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"28⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3592 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵PID:4044
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"29⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5116 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵PID:4936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵PID:4564
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"30⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4572 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵PID:1788
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵PID:3584
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"31⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3780 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵PID:768
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"32⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4692 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵PID:2276
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"33⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4252 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵PID:4072
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"34⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2668 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵PID:4468
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"35⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3204 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵PID:4812
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"36⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2956 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵PID:3688
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"37⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5116 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵PID:1428
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵PID:2540
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵PID:2036
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"38⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3964 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵PID:3740
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵PID:4004
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"39⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3252 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵PID:4520
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵PID:2332
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"40⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4384 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵PID:3908
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"41⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4080 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵PID:3112
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵PID:3312
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"42⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4600 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵PID:1640
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"43⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:744 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵PID:588
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"44⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3068 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵PID:4076
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"45⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵PID:896
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵PID:4988
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵PID:428
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"46⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1240 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵PID:2980
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵PID:4884
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"47⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2668 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵PID:2952
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"48⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3060 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵PID:3852
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵PID:1500
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"49⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4332 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵PID:3360
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵PID:2064
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵PID:216
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"50⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1428 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵PID:2540
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"51⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3584 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"52⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1184 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵PID:3068
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"53⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4912 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵PID:2552
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"54⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1392 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵PID:4412
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"55⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:652 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵PID:2468
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"56⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4244 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵PID:3432
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"57⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4044 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵PID:3256
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵PID:3200
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"58⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2312 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵PID:2128
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"59⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4716 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵PID:3684
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"60⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3508 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵PID:4444
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"61⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4320 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵PID:4920
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"62⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4436 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵PID:4668
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵PID:5044
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"63⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1628 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵PID:844
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"64⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
PID:4408 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵PID:4888
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"65⤵
- Checks computer location settings
PID:2116 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵PID:4356
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵PID:4228
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"66⤵PID:5012
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵PID:4824
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"67⤵PID:3920
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵PID:1648
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵PID:3952
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"68⤵
- Checks computer location settings
PID:3720 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵PID:4384
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵PID:4360
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵PID:708
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"69⤵PID:2556
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵PID:1308
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"70⤵
- Checks computer location settings
PID:2692 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵PID:2348
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵PID:2000
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"71⤵
- Checks computer location settings
PID:4524 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵PID:3764
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵PID:4476
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵PID:4912
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"72⤵PID:3692
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵PID:1392
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"73⤵PID:2552
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵PID:4488
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵PID:3020
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵PID:212
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵PID:4468
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵PID:1492
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"74⤵PID:1720
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵PID:3204
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"75⤵
- Checks computer location settings
PID:2948 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵PID:2616
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"76⤵PID:1484
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵PID:1040
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"77⤵PID:3920
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵PID:3876
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵PID:744
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵PID:676
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"78⤵PID:1388
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵PID:2336
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"79⤵PID:3032
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵PID:4708
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵PID:4328
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵PID:3684
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"80⤵PID:220
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵PID:3568
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵PID:4244
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"81⤵
- Checks computer location settings
PID:4568 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵PID:4220
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"82⤵PID:4816
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵PID:3908
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"83⤵PID:4492
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵PID:5044
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"84⤵PID:1160
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵PID:4352
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"85⤵PID:3524
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵PID:3432
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"86⤵
- Checks computer location settings
PID:3780 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵PID:848
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"87⤵PID:3508
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵PID:1016
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"88⤵PID:4824
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵PID:2540
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"89⤵PID:4468
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"90⤵PID:3364
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"90⤵
- Checks computer location settings
PID:2800 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵PID:2952
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵PID:708
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"91⤵
- Checks computer location settings
PID:428 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"92⤵PID:4524
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"92⤵PID:4320
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"93⤵PID:3692
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"93⤵PID:2904
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"94⤵PID:3360
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"94⤵
- Checks computer location settings
PID:4808 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵PID:3824
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"95⤵
- Checks computer location settings
PID:1528 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵PID:4076
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"96⤵PID:3268
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵PID:4276
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"97⤵
- Checks computer location settings
PID:4340 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"98⤵PID:1240
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"98⤵
- Checks computer location settings
PID:2324 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"99⤵PID:1040
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"99⤵PID:3556
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵PID:1632
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵PID:2304
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"100⤵PID:4236
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"101⤵PID:3060
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"101⤵
- Checks computer location settings
PID:5068 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵PID:2328
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵PID:2980
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵PID:4568
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"102⤵
- Checks computer location settings
PID:4996 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵PID:840
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵PID:4680
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"103⤵PID:1648
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵PID:3908
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"104⤵PID:5056
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"105⤵PID:3416
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"105⤵PID:3720
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵PID:5060
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"106⤵PID:1168
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"107⤵PID:4536
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"107⤵PID:2160
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"108⤵PID:3100
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"108⤵PID:4600
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵PID:2572
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵PID:3772
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"109⤵
- Checks computer location settings
PID:3796 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"110⤵PID:2996
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"110⤵PID:676
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"110⤵
- Checks computer location settings
PID:4816 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵PID:3068
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"111⤵PID:4236
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵PID:2176
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵PID:2992
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"112⤵PID:4716
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"113⤵PID:5104
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"113⤵PID:4992
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"114⤵PID:752
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"114⤵PID:4652
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"114⤵
- Checks computer location settings
PID:412 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"115⤵PID:3288
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"115⤵PID:3960
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵PID:760
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"116⤵
- Checks computer location settings
PID:4028 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵PID:3720
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"117⤵PID:3052
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"118⤵PID:2168
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"118⤵PID:4900
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"118⤵
- Checks computer location settings
PID:1788 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵PID:2328
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"119⤵PID:3332
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"120⤵PID:4472
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"120⤵
- Checks computer location settings
PID:3556 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"121⤵PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d6504033e0108dd331c3514c9b92772_JaffaCakes118.exe"121⤵
- Checks computer location settings
PID:3740 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵PID:4484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-