Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 21:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe
Resource
win7-20240708-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe
-
Size
210KB
-
MD5
32032f2c3b93a6390b4fbbaae542d096
-
SHA1
d1f998767a37a48a60bcdfb679fa2c1897a8f2c3
-
SHA256
1194e2d668d194adefc5b2c5f03cc93c3ce69a34e3fb7bc398dcde9cb0ad929d
-
SHA512
eab0f5b2c0ca855b95ce932f59bd13267aaada995bb3b8e00459206ba2e20176c0640a9cd3b5b90e91870b50231e8feb28269e13e1c13a42e879bcf0109ebf85
-
SSDEEP
6144:GPNac+AH+L0j2jF2Ssv5pe5t+R3IIhIIW:GImhGQTFIIhII
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4408 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 1968 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 628 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 2980 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4156 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4612 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4532 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 1244 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4856 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 3796 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4928 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4492 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 876 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 2792 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 212 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 800 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 1048 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 1656 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 944 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 3564 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 1596 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 3000 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4588 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 2472 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 3088 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4932 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 5060 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 464 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4616 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4396 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4812 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4956 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 5092 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 1264 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 1236 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4432 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 3600 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 3024 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4268 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4012 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 3916 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 2636 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4688 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 3772 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 2424 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4168 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4508 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4532 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 3580 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 3616 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 216 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 228 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4944 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4924 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 448 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 4276 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 212 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 800 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 1048 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 1656 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 944 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 3564 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 1596 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe Token: SeDebugPrivilege 1892 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4408 wrote to memory of 1968 4408 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 83 PID 4408 wrote to memory of 1968 4408 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 83 PID 1968 wrote to memory of 628 1968 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 84 PID 1968 wrote to memory of 628 1968 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 84 PID 628 wrote to memory of 2980 628 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 85 PID 628 wrote to memory of 2980 628 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 85 PID 2980 wrote to memory of 4156 2980 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 86 PID 2980 wrote to memory of 4156 2980 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 86 PID 4156 wrote to memory of 4612 4156 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 87 PID 4156 wrote to memory of 4612 4156 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 87 PID 4612 wrote to memory of 4532 4612 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 88 PID 4612 wrote to memory of 4532 4612 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 88 PID 4532 wrote to memory of 1244 4532 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 90 PID 4532 wrote to memory of 1244 4532 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 90 PID 1244 wrote to memory of 4856 1244 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 91 PID 1244 wrote to memory of 4856 1244 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 91 PID 4856 wrote to memory of 3796 4856 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 92 PID 4856 wrote to memory of 3796 4856 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 92 PID 3796 wrote to memory of 4928 3796 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 93 PID 3796 wrote to memory of 4928 3796 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 93 PID 4928 wrote to memory of 4492 4928 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 94 PID 4928 wrote to memory of 4492 4928 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 94 PID 4492 wrote to memory of 876 4492 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 95 PID 4492 wrote to memory of 876 4492 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 95 PID 876 wrote to memory of 2792 876 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 96 PID 876 wrote to memory of 2792 876 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 96 PID 2792 wrote to memory of 212 2792 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 97 PID 2792 wrote to memory of 212 2792 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 97 PID 212 wrote to memory of 800 212 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 98 PID 212 wrote to memory of 800 212 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 98 PID 800 wrote to memory of 1048 800 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 99 PID 800 wrote to memory of 1048 800 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 99 PID 1048 wrote to memory of 1656 1048 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 100 PID 1048 wrote to memory of 1656 1048 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 100 PID 1656 wrote to memory of 944 1656 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 101 PID 1656 wrote to memory of 944 1656 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 101 PID 944 wrote to memory of 3564 944 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 102 PID 944 wrote to memory of 3564 944 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 102 PID 3564 wrote to memory of 1596 3564 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 103 PID 3564 wrote to memory of 1596 3564 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 103 PID 1596 wrote to memory of 3000 1596 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 104 PID 1596 wrote to memory of 3000 1596 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 104 PID 3000 wrote to memory of 4588 3000 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 105 PID 3000 wrote to memory of 4588 3000 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 105 PID 4588 wrote to memory of 2472 4588 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 106 PID 4588 wrote to memory of 2472 4588 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 106 PID 2472 wrote to memory of 3088 2472 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 107 PID 2472 wrote to memory of 3088 2472 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 107 PID 3088 wrote to memory of 4932 3088 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 108 PID 3088 wrote to memory of 4932 3088 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 108 PID 4932 wrote to memory of 5060 4932 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 109 PID 4932 wrote to memory of 5060 4932 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 109 PID 5060 wrote to memory of 464 5060 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 110 PID 5060 wrote to memory of 464 5060 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 110 PID 464 wrote to memory of 4616 464 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 111 PID 464 wrote to memory of 4616 464 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 111 PID 4616 wrote to memory of 4396 4616 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 112 PID 4616 wrote to memory of 4396 4616 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 112 PID 4396 wrote to memory of 4812 4396 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 113 PID 4396 wrote to memory of 4812 4396 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 113 PID 4812 wrote to memory of 4956 4812 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 114 PID 4812 wrote to memory of 4956 4812 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 114 PID 4956 wrote to memory of 5092 4956 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 115 PID 4956 wrote to memory of 5092 4956 32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:216 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:228 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:448 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:212 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:800 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:944 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe65⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe66⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe67⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe68⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe69⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe70⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe71⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe72⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe73⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe74⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe75⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe76⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe77⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe78⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe79⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe80⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe81⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe82⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe83⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe84⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe85⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe86⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe87⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe88⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe89⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe90⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe91⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe92⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe93⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe94⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe95⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe96⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe97⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe98⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe99⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe100⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe101⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe102⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe103⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe104⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe105⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe106⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe107⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe108⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe109⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe110⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe111⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe112⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe113⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe114⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe115⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe116⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe117⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe118⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe119⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe120⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe121⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\32032f2c3b93a6390b4fbbaae542d096_JaffaCakes118.exe122⤵PID:3408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-