Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 14:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe
Resource
win7-20240508-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe
Resource
win10v2004-20240611-en
4 signatures
150 seconds
General
-
Target
0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe
-
Size
70KB
-
MD5
0e5f3c9af4d77fb6acb6d150cd0b723a
-
SHA1
c0e83d0eefb195ad9d880f63d2ca5dfc87e40112
-
SHA256
500a05ca0d73ad438ea6cefd3155a3f079c38abbec4bbdddfa17b1a2935c8112
-
SHA512
82cc08ade5195481eeaa64004d5b69c4d9cd1c82001610622de511123d36a03d59be3614c89e4762c7cad3cc8311fc37c88e013147202cc27832cdc2cd50cca7
-
SSDEEP
1536:sByy+3kUQQul2xQeF7Gm4CZZD4espOtb9DmC6R0GleBUOw:RybUmpa5PEeuOtbBKiGP
Score
6/10
Malware Config
Signatures
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe File opened for modification C:\Windows\assembly 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1856 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 1856 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1856 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 4568 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 4568 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4568 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 1776 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 1776 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1776 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 2504 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 2504 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2504 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 2192 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 2192 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2192 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 1088 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 1088 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1088 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 4148 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 4148 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4148 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 4324 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 4324 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4324 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 2816 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 2816 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2816 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 3648 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 3648 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3648 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 4452 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 4452 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4452 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 3996 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 3996 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3996 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 3748 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 3748 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3748 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 4072 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 4072 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4072 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 2824 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 2824 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2824 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 2924 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 2924 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2924 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 1212 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 1212 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1212 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 1484 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 1484 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1484 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 4520 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 4520 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4520 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 3464 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 3464 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3464 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 3304 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: 33 3304 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3304 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe Token: SeDebugPrivilege 4868 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1856 wrote to memory of 4568 1856 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 85 PID 1856 wrote to memory of 4568 1856 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 85 PID 4568 wrote to memory of 1776 4568 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 86 PID 4568 wrote to memory of 1776 4568 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 86 PID 1776 wrote to memory of 2504 1776 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 87 PID 1776 wrote to memory of 2504 1776 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 87 PID 2504 wrote to memory of 2192 2504 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 88 PID 2504 wrote to memory of 2192 2504 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 88 PID 2192 wrote to memory of 1088 2192 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 89 PID 2192 wrote to memory of 1088 2192 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 89 PID 1088 wrote to memory of 4148 1088 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 90 PID 1088 wrote to memory of 4148 1088 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 90 PID 4148 wrote to memory of 4324 4148 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 91 PID 4148 wrote to memory of 4324 4148 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 91 PID 4324 wrote to memory of 2816 4324 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 92 PID 4324 wrote to memory of 2816 4324 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 92 PID 2816 wrote to memory of 3648 2816 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 93 PID 2816 wrote to memory of 3648 2816 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 93 PID 3648 wrote to memory of 4452 3648 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 94 PID 3648 wrote to memory of 4452 3648 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 94 PID 4452 wrote to memory of 3996 4452 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 95 PID 4452 wrote to memory of 3996 4452 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 95 PID 3996 wrote to memory of 3748 3996 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 96 PID 3996 wrote to memory of 3748 3996 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 96 PID 3748 wrote to memory of 4072 3748 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 97 PID 3748 wrote to memory of 4072 3748 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 97 PID 4072 wrote to memory of 2824 4072 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 98 PID 4072 wrote to memory of 2824 4072 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 98 PID 2824 wrote to memory of 2924 2824 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 99 PID 2824 wrote to memory of 2924 2824 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 99 PID 2924 wrote to memory of 1212 2924 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 100 PID 2924 wrote to memory of 1212 2924 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 100 PID 1212 wrote to memory of 1484 1212 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 101 PID 1212 wrote to memory of 1484 1212 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 101 PID 1484 wrote to memory of 4520 1484 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 102 PID 1484 wrote to memory of 4520 1484 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 102 PID 4520 wrote to memory of 3464 4520 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 103 PID 4520 wrote to memory of 3464 4520 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 103 PID 3464 wrote to memory of 3304 3464 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 104 PID 3464 wrote to memory of 3304 3464 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 104 PID 3304 wrote to memory of 4868 3304 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 105 PID 3304 wrote to memory of 4868 3304 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 105 PID 4868 wrote to memory of 4068 4868 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 106 PID 4868 wrote to memory of 4068 4868 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 106 PID 4068 wrote to memory of 5008 4068 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 107 PID 4068 wrote to memory of 5008 4068 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 107 PID 5008 wrote to memory of 2480 5008 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 110 PID 5008 wrote to memory of 2480 5008 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 110 PID 2480 wrote to memory of 2692 2480 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 111 PID 2480 wrote to memory of 2692 2480 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 111 PID 2692 wrote to memory of 4012 2692 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 112 PID 2692 wrote to memory of 4012 2692 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 112 PID 4012 wrote to memory of 1676 4012 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 113 PID 4012 wrote to memory of 1676 4012 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 113 PID 1676 wrote to memory of 4592 1676 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 114 PID 1676 wrote to memory of 4592 1676 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 114 PID 4592 wrote to memory of 4596 4592 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 115 PID 4592 wrote to memory of 4596 4592 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 115 PID 4596 wrote to memory of 4380 4596 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 116 PID 4596 wrote to memory of 4380 4596 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 116 PID 4380 wrote to memory of 2120 4380 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 117 PID 4380 wrote to memory of 2120 4380 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 117 PID 2120 wrote to memory of 452 2120 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 118 PID 2120 wrote to memory of 452 2120 0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe23⤵
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe24⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe25⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe26⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe27⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe28⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe29⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe30⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe31⤵
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe32⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe33⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe34⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe35⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe36⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe37⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe38⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe39⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe40⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe41⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe42⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe43⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe44⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe45⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe46⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe47⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe48⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe49⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe50⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe51⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe52⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe53⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe54⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe55⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe56⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe57⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe58⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe59⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe60⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe61⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe62⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe63⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe64⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe65⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe66⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe67⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe68⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe69⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe70⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe71⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe72⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe73⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe74⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe75⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe76⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe77⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe78⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe79⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe80⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe81⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe82⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe83⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe84⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe85⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe86⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe87⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe88⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe89⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe90⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe91⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe92⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe93⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe94⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe95⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe96⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe97⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe98⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe99⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe100⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe101⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe102⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe103⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe104⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe105⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe106⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe107⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe108⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe109⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe110⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe111⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe112⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe113⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe114⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe115⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe116⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe117⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe118⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe119⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe120⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe121⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e5f3c9af4d77fb6acb6d150cd0b723a_JaffaCakes118.exe122⤵PID:4048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-