Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 07:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0731d9729d540688b702c84fcc168035_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0731d9729d540688b702c84fcc168035_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
0731d9729d540688b702c84fcc168035_JaffaCakes118.exe
-
Size
174KB
-
MD5
0731d9729d540688b702c84fcc168035
-
SHA1
b334f8524820874c042f91d43f606dae4eb7c663
-
SHA256
a15bdf3835491d4023eba2d09c19227cc1acb92ff0550e5a6aad6d463aca3bc6
-
SHA512
7319d64c647e7624a55650a9594acf85e08ded21f3f204f9af7cafa747c8c5c8b8fa085e2f2902520167eff9fbb266aa3cca090bca25d784717f2b095a8c7e2f
-
SSDEEP
3072:iE1PNqLAxOU+If3wyU+k363UT1r1e8KlNNsFJyVIvig9lp9phExIHGRvjznlQSV0:tPNqLuopyU+CrTV1eTlNNsv5pe5t+R3o
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3620 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2440 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2960 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 4296 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1476 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2128 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 3352 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 3928 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1356 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 612 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2904 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1584 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1156 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 3012 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1432 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2472 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 964 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 4444 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 4396 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 3532 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1692 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 3444 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2312 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2708 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 3456 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 4780 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 4620 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 4400 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 316 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 3416 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1296 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1212 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 4360 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1856 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1796 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1516 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 4508 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1576 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 3236 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 3948 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1208 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 3120 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 4856 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2000 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2712 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 4028 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2032 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1976 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 5036 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 3168 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1156 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 4848 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2480 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 1884 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 4000 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 3028 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 380 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2408 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 3444 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2468 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 4116 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 2912 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 3960 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe Token: SeDebugPrivilege 4980 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3620 wrote to memory of 2440 3620 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 87 PID 3620 wrote to memory of 2440 3620 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 87 PID 2440 wrote to memory of 2960 2440 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 88 PID 2440 wrote to memory of 2960 2440 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 88 PID 2960 wrote to memory of 4296 2960 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 89 PID 2960 wrote to memory of 4296 2960 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 89 PID 4296 wrote to memory of 1476 4296 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 90 PID 4296 wrote to memory of 1476 4296 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 90 PID 1476 wrote to memory of 2128 1476 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 91 PID 1476 wrote to memory of 2128 1476 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 91 PID 2128 wrote to memory of 3352 2128 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 92 PID 2128 wrote to memory of 3352 2128 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 92 PID 3352 wrote to memory of 3928 3352 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 93 PID 3352 wrote to memory of 3928 3352 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 93 PID 3928 wrote to memory of 1356 3928 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 94 PID 3928 wrote to memory of 1356 3928 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 94 PID 1356 wrote to memory of 612 1356 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 95 PID 1356 wrote to memory of 612 1356 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 95 PID 612 wrote to memory of 2904 612 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 135 PID 612 wrote to memory of 2904 612 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 135 PID 2904 wrote to memory of 1584 2904 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 97 PID 2904 wrote to memory of 1584 2904 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 97 PID 1584 wrote to memory of 1156 1584 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 137 PID 1584 wrote to memory of 1156 1584 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 137 PID 1156 wrote to memory of 3012 1156 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 99 PID 1156 wrote to memory of 3012 1156 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 99 PID 3012 wrote to memory of 1432 3012 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 100 PID 3012 wrote to memory of 1432 3012 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 100 PID 1432 wrote to memory of 2472 1432 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 101 PID 1432 wrote to memory of 2472 1432 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 101 PID 2472 wrote to memory of 964 2472 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 102 PID 2472 wrote to memory of 964 2472 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 102 PID 964 wrote to memory of 4444 964 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 103 PID 964 wrote to memory of 4444 964 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 103 PID 4444 wrote to memory of 4396 4444 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 104 PID 4444 wrote to memory of 4396 4444 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 104 PID 4396 wrote to memory of 3532 4396 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 105 PID 4396 wrote to memory of 3532 4396 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 105 PID 3532 wrote to memory of 1692 3532 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 106 PID 3532 wrote to memory of 1692 3532 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 106 PID 1692 wrote to memory of 3444 1692 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 145 PID 1692 wrote to memory of 3444 1692 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 145 PID 3444 wrote to memory of 2312 3444 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 108 PID 3444 wrote to memory of 2312 3444 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 108 PID 2312 wrote to memory of 2708 2312 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 109 PID 2312 wrote to memory of 2708 2312 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 109 PID 2708 wrote to memory of 3456 2708 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 110 PID 2708 wrote to memory of 3456 2708 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 110 PID 3456 wrote to memory of 4780 3456 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 111 PID 3456 wrote to memory of 4780 3456 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 111 PID 4780 wrote to memory of 4620 4780 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 112 PID 4780 wrote to memory of 4620 4780 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 112 PID 4620 wrote to memory of 4400 4620 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 113 PID 4620 wrote to memory of 4400 4620 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 113 PID 4400 wrote to memory of 316 4400 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 114 PID 4400 wrote to memory of 316 4400 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 114 PID 316 wrote to memory of 3416 316 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 115 PID 316 wrote to memory of 3416 316 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 115 PID 3416 wrote to memory of 1296 3416 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 116 PID 3416 wrote to memory of 1296 3416 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 116 PID 1296 wrote to memory of 1212 1296 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 117 PID 1296 wrote to memory of 1212 1296 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 117 PID 1212 wrote to memory of 4360 1212 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 118 PID 1212 wrote to memory of 4360 1212 0731d9729d540688b702c84fcc168035_JaffaCakes118.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:380 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe65⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe66⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe67⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe68⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe69⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe70⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe71⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe72⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe73⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe74⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe75⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe76⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe77⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe78⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe79⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe80⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe81⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe82⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe83⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe84⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe85⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe86⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe87⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe88⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe89⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe90⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe91⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe92⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe93⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe94⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe95⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe96⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe97⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe98⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe99⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe100⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe101⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe102⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe103⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe104⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe105⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe106⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe107⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe108⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe109⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe110⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe111⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe112⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe113⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe114⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe115⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe116⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe117⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe118⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe119⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe120⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe121⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0731d9729d540688b702c84fcc168035_JaffaCakes118.exe122⤵PID:4388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-