Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 09:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe
-
Size
180KB
-
MD5
04b0e9756c6a99e16ba2dcf6cc3953e2
-
SHA1
30976bfc2e832aad5a38ae513a436a3ebc878ef8
-
SHA256
c180324ea070eeccd6ef4e5bca8e276ece2334f6121bf31367efc033ef0a49dd
-
SHA512
322bdbfa4619ed5f4253d06c68fd2216561197abde2081e62d5c07d77d35843b9b5ec2b34b8e7b716761d0666d4cf444ec2c09862a7383ed62587f53d9016b2a
-
SSDEEP
3072:jJtQMdQ9o6LrPMJB7GPTMy6LC3OKogH9fsdMLtIji1xzt78lCDsw:dCr0nqPI/LC3fogHJsdMRIot7wCDsw
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1740 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1212 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1300 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2696 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2616 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2728 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2932 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2764 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2776 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 3068 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2604 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2496 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2524 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1624 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2072 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2000 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1796 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2800 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2820 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2872 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2912 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2876 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1456 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2368 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2028 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1536 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1568 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1828 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1124 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1532 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2788 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2580 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 992 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 3044 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 3024 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1268 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2300 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 3048 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 3036 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2816 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1968 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2948 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2088 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2856 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 336 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 452 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 740 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1104 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 564 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 3008 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1804 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1136 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1152 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2464 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2296 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1980 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1560 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1800 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1328 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1872 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 2940 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 1780 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 920 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe Token: SeDebugPrivilege 708 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1212 1740 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 28 PID 1740 wrote to memory of 1212 1740 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 28 PID 1740 wrote to memory of 1212 1740 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 28 PID 1212 wrote to memory of 1300 1212 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 29 PID 1212 wrote to memory of 1300 1212 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 29 PID 1212 wrote to memory of 1300 1212 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 29 PID 1300 wrote to memory of 2696 1300 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 30 PID 1300 wrote to memory of 2696 1300 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 30 PID 1300 wrote to memory of 2696 1300 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 30 PID 2696 wrote to memory of 2616 2696 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2616 2696 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2616 2696 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 31 PID 2616 wrote to memory of 2728 2616 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 32 PID 2616 wrote to memory of 2728 2616 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 32 PID 2616 wrote to memory of 2728 2616 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 32 PID 2728 wrote to memory of 2932 2728 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 33 PID 2728 wrote to memory of 2932 2728 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 33 PID 2728 wrote to memory of 2932 2728 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 33 PID 2932 wrote to memory of 2764 2932 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 34 PID 2932 wrote to memory of 2764 2932 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 34 PID 2932 wrote to memory of 2764 2932 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 34 PID 2764 wrote to memory of 2776 2764 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 35 PID 2764 wrote to memory of 2776 2764 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 35 PID 2764 wrote to memory of 2776 2764 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 35 PID 2776 wrote to memory of 3068 2776 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 36 PID 2776 wrote to memory of 3068 2776 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 36 PID 2776 wrote to memory of 3068 2776 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 36 PID 3068 wrote to memory of 2604 3068 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 37 PID 3068 wrote to memory of 2604 3068 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 37 PID 3068 wrote to memory of 2604 3068 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 37 PID 2604 wrote to memory of 2496 2604 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 38 PID 2604 wrote to memory of 2496 2604 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 38 PID 2604 wrote to memory of 2496 2604 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 38 PID 2496 wrote to memory of 2524 2496 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 39 PID 2496 wrote to memory of 2524 2496 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 39 PID 2496 wrote to memory of 2524 2496 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 39 PID 2524 wrote to memory of 1624 2524 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 40 PID 2524 wrote to memory of 1624 2524 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 40 PID 2524 wrote to memory of 1624 2524 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 40 PID 1624 wrote to memory of 2072 1624 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 41 PID 1624 wrote to memory of 2072 1624 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 41 PID 1624 wrote to memory of 2072 1624 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 41 PID 2072 wrote to memory of 2000 2072 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 42 PID 2072 wrote to memory of 2000 2072 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 42 PID 2072 wrote to memory of 2000 2072 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 42 PID 2000 wrote to memory of 1796 2000 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 43 PID 2000 wrote to memory of 1796 2000 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 43 PID 2000 wrote to memory of 1796 2000 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 43 PID 1796 wrote to memory of 2800 1796 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 44 PID 1796 wrote to memory of 2800 1796 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 44 PID 1796 wrote to memory of 2800 1796 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 44 PID 2800 wrote to memory of 2820 2800 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 45 PID 2800 wrote to memory of 2820 2800 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 45 PID 2800 wrote to memory of 2820 2800 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 45 PID 2820 wrote to memory of 2872 2820 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 46 PID 2820 wrote to memory of 2872 2820 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 46 PID 2820 wrote to memory of 2872 2820 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 46 PID 2872 wrote to memory of 2912 2872 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 47 PID 2872 wrote to memory of 2912 2872 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 47 PID 2872 wrote to memory of 2912 2872 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 47 PID 2912 wrote to memory of 2876 2912 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 48 PID 2912 wrote to memory of 2876 2912 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 48 PID 2912 wrote to memory of 2876 2912 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 48 PID 2876 wrote to memory of 1456 2876 04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:992 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:336 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:452 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:740 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:564 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:920 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:708 -
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe65⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe66⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe67⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe68⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe69⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe70⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe71⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe72⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe73⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe74⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe75⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe76⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe77⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe78⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe79⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe80⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe81⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe82⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe83⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe84⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe85⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe86⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe87⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe88⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe89⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe90⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe91⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe92⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe93⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe94⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe95⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe96⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe97⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe98⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe99⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe100⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe101⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe102⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe103⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe104⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe105⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe106⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe107⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe108⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe109⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe110⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe111⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe112⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe113⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe114⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe115⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe116⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe117⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe118⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe119⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe120⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe121⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\04b0e9756c6a99e16ba2dcf6cc3953e2_JaffaCakes118.exe122⤵PID:2960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-