Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 07:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0731d9729d540688b702c84fcc168035_JaffaCakes118.exe
Resource
win7-20240508-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0731d9729d540688b702c84fcc168035_JaffaCakes118.exe
Resource
win10v2004-20240611-en
2 signatures
150 seconds
General
-
Target
0731d9729d540688b702c84fcc168035_JaffaCakes118.exe
-
Size
174KB
-
MD5
0731d9729d540688b702c84fcc168035
-
SHA1
b334f8524820874c042f91d43f606dae4eb7c663
-
SHA256
a15bdf3835491d4023eba2d09c19227cc1acb92ff0550e5a6aad6d463aca3bc6
-
SHA512
7319d64c647e7624a55650a9594acf85e08ded21f3f204f9af7cafa747c8c5c8b8fa085e2f2902520167eff9fbb266aa3cca090bca25d784717f2b095a8c7e2f
-
SSDEEP
3072:iE1PNqLAxOU+If3wyU+k363UT1r1e8KlNNsFJyVIvig9lp9phExIHGRvjznlQSV0:tPNqLuopyU+CrTV1eTlNNsv5pe5t+R3o
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1924 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2756 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 3028 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2680 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2616 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2748 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2496 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2636 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2484 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2864 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2880 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1540 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2356 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 860 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1276 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2160 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2172 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1504 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 268 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1232 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2528 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2084 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2280 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2288 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2564 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 332 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 912 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 996 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2436 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2348 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1920 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1004 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1524 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1784 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2928 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1124 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1460 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1928 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2844 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 896 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2076 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1640 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2572 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2916 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2804 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2708 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2592 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2700 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2724 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2472 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2588 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2948 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1636 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2196 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1424 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2424 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1628 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1276 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2160 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1564 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 316 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2040 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2024 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2568 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2756 1924 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 28 PID 1924 wrote to memory of 2756 1924 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 28 PID 1924 wrote to memory of 2756 1924 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 28 PID 2756 wrote to memory of 3028 2756 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 29 PID 2756 wrote to memory of 3028 2756 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 29 PID 2756 wrote to memory of 3028 2756 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 29 PID 3028 wrote to memory of 2680 3028 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 30 PID 3028 wrote to memory of 2680 3028 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 30 PID 3028 wrote to memory of 2680 3028 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 30 PID 2680 wrote to memory of 2616 2680 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 31 PID 2680 wrote to memory of 2616 2680 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 31 PID 2680 wrote to memory of 2616 2680 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 31 PID 2616 wrote to memory of 2748 2616 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 32 PID 2616 wrote to memory of 2748 2616 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 32 PID 2616 wrote to memory of 2748 2616 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 32 PID 2748 wrote to memory of 2496 2748 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 33 PID 2748 wrote to memory of 2496 2748 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 33 PID 2748 wrote to memory of 2496 2748 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 33 PID 2496 wrote to memory of 2636 2496 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 34 PID 2496 wrote to memory of 2636 2496 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 34 PID 2496 wrote to memory of 2636 2496 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 34 PID 2636 wrote to memory of 2484 2636 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 35 PID 2636 wrote to memory of 2484 2636 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 35 PID 2636 wrote to memory of 2484 2636 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 35 PID 2484 wrote to memory of 2864 2484 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 36 PID 2484 wrote to memory of 2864 2484 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 36 PID 2484 wrote to memory of 2864 2484 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 36 PID 2864 wrote to memory of 2880 2864 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 37 PID 2864 wrote to memory of 2880 2864 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 37 PID 2864 wrote to memory of 2880 2864 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 37 PID 2880 wrote to memory of 1540 2880 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 38 PID 2880 wrote to memory of 1540 2880 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 38 PID 2880 wrote to memory of 1540 2880 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 38 PID 1540 wrote to memory of 2356 1540 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 39 PID 1540 wrote to memory of 2356 1540 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 39 PID 1540 wrote to memory of 2356 1540 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 39 PID 2356 wrote to memory of 860 2356 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 40 PID 2356 wrote to memory of 860 2356 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 40 PID 2356 wrote to memory of 860 2356 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 40 PID 860 wrote to memory of 1276 860 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 41 PID 860 wrote to memory of 1276 860 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 41 PID 860 wrote to memory of 1276 860 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 41 PID 1276 wrote to memory of 2160 1276 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 42 PID 1276 wrote to memory of 2160 1276 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 42 PID 1276 wrote to memory of 2160 1276 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 42 PID 2160 wrote to memory of 2172 2160 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 43 PID 2160 wrote to memory of 2172 2160 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 43 PID 2160 wrote to memory of 2172 2160 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 43 PID 2172 wrote to memory of 1504 2172 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 44 PID 2172 wrote to memory of 1504 2172 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 44 PID 2172 wrote to memory of 1504 2172 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 44 PID 1504 wrote to memory of 268 1504 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 45 PID 1504 wrote to memory of 268 1504 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 45 PID 1504 wrote to memory of 268 1504 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 45 PID 268 wrote to memory of 1232 268 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 46 PID 268 wrote to memory of 1232 268 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 46 PID 268 wrote to memory of 1232 268 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 46 PID 1232 wrote to memory of 2528 1232 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 47 PID 1232 wrote to memory of 2528 1232 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 47 PID 1232 wrote to memory of 2528 1232 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 47 PID 2528 wrote to memory of 2084 2528 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 48 PID 2528 wrote to memory of 2084 2528 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 48 PID 2528 wrote to memory of 2084 2528 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 48 PID 2084 wrote to memory of 2280 2084 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
PID:332 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
PID:912 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
PID:996 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:896 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:316 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe65⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe66⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe67⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe68⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe69⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe70⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe71⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe72⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe73⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe74⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe75⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe76⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe77⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe78⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe79⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe80⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe81⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe82⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe83⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe84⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe85⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe86⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe87⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe88⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe89⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe90⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe91⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe92⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe93⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe94⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe95⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe96⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe97⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe98⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe99⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe100⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe101⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe102⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe103⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe104⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe105⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe106⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe107⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe108⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe109⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe110⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe111⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe112⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe113⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe114⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe115⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe116⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe117⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe118⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe119⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe120⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe121⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe122⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-