Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 03:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe
Resource
win7-20240704-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe
-
Size
57KB
-
MD5
5a5a568226efbf58bb3f015dba25682b
-
SHA1
2798118b8b18257b2dac1109b7e26ff66ed26d27
-
SHA256
d90881ca5829f50289c4c7ba3272537ef44c8ace1cc34fbf9310f2958dfb0f06
-
SHA512
d11d2e09733064ca7fc30044d01093132542220feae6baa72b0f0c922ec39679c2d05869ae6292b827a2445637484314e63976554aae282d088a05cb00635f21
-
SSDEEP
1536:Zfc3Sm5lJL8J5OqF/fg4mnGg+0D4yby5p1AO81:LmDJoVf/+b4rb1N81
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2460 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1640 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3020 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2160 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2664 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2668 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2920 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2604 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2004 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2516 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2580 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3028 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2496 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1416 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2336 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1092 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2744 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2116 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2328 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 764 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2360 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2948 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2372 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2384 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2876 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2024 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 596 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 812 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 884 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2228 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2348 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1360 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1692 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 992 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1936 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2432 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 544 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2820 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2052 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3048 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2484 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2272 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1816 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2696 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2716 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2676 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2664 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2812 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 920 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2652 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2560 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3000 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3008 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3016 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2556 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2576 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2756 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2832 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 344 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 556 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1500 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2944 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2124 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2068 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2460 wrote to memory of 1640 2460 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 30 PID 2460 wrote to memory of 1640 2460 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 30 PID 2460 wrote to memory of 1640 2460 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 30 PID 1640 wrote to memory of 3020 1640 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 31 PID 1640 wrote to memory of 3020 1640 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 31 PID 1640 wrote to memory of 3020 1640 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 31 PID 3020 wrote to memory of 2160 3020 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 32 PID 3020 wrote to memory of 2160 3020 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 32 PID 3020 wrote to memory of 2160 3020 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 32 PID 2160 wrote to memory of 2664 2160 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 75 PID 2160 wrote to memory of 2664 2160 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 75 PID 2160 wrote to memory of 2664 2160 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 75 PID 2664 wrote to memory of 2668 2664 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 34 PID 2664 wrote to memory of 2668 2664 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 34 PID 2664 wrote to memory of 2668 2664 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 34 PID 2668 wrote to memory of 2920 2668 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 35 PID 2668 wrote to memory of 2920 2668 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 35 PID 2668 wrote to memory of 2920 2668 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 35 PID 2920 wrote to memory of 2604 2920 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 36 PID 2920 wrote to memory of 2604 2920 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 36 PID 2920 wrote to memory of 2604 2920 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 36 PID 2604 wrote to memory of 2004 2604 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 37 PID 2604 wrote to memory of 2004 2604 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 37 PID 2604 wrote to memory of 2004 2604 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 37 PID 2004 wrote to memory of 2516 2004 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 38 PID 2004 wrote to memory of 2516 2004 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 38 PID 2004 wrote to memory of 2516 2004 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 38 PID 2516 wrote to memory of 2580 2516 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 39 PID 2516 wrote to memory of 2580 2516 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 39 PID 2516 wrote to memory of 2580 2516 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 39 PID 2580 wrote to memory of 3028 2580 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 40 PID 2580 wrote to memory of 3028 2580 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 40 PID 2580 wrote to memory of 3028 2580 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 40 PID 3028 wrote to memory of 2496 3028 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 41 PID 3028 wrote to memory of 2496 3028 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 41 PID 3028 wrote to memory of 2496 3028 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 41 PID 2496 wrote to memory of 1416 2496 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 42 PID 2496 wrote to memory of 1416 2496 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 42 PID 2496 wrote to memory of 1416 2496 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 42 PID 1416 wrote to memory of 2336 1416 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 43 PID 1416 wrote to memory of 2336 1416 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 43 PID 1416 wrote to memory of 2336 1416 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 43 PID 2336 wrote to memory of 1092 2336 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 44 PID 2336 wrote to memory of 1092 2336 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 44 PID 2336 wrote to memory of 1092 2336 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 44 PID 1092 wrote to memory of 2744 1092 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 45 PID 1092 wrote to memory of 2744 1092 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 45 PID 1092 wrote to memory of 2744 1092 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 45 PID 2744 wrote to memory of 2116 2744 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 46 PID 2744 wrote to memory of 2116 2744 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 46 PID 2744 wrote to memory of 2116 2744 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 46 PID 2116 wrote to memory of 2328 2116 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 47 PID 2116 wrote to memory of 2328 2116 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 47 PID 2116 wrote to memory of 2328 2116 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 47 PID 2328 wrote to memory of 764 2328 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 48 PID 2328 wrote to memory of 764 2328 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 48 PID 2328 wrote to memory of 764 2328 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 48 PID 764 wrote to memory of 2360 764 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 49 PID 764 wrote to memory of 2360 764 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 49 PID 764 wrote to memory of 2360 764 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 49 PID 2360 wrote to memory of 2948 2360 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 50 PID 2360 wrote to memory of 2948 2360 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 50 PID 2360 wrote to memory of 2948 2360 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 50 PID 2948 wrote to memory of 2372 2948 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 51
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
PID:596 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
PID:812 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
PID:884 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:992 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:544 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:920 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:344 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:556 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe65⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe66⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe67⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe68⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe69⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe70⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe71⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe72⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe73⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe74⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe75⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe76⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe77⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe78⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe79⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe80⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe81⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe82⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe83⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe84⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe85⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe86⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe87⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe88⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe89⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe90⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe91⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe92⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe93⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe94⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe95⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe96⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe97⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe98⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe99⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe100⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe101⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe102⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe103⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe104⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe105⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe106⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe107⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe108⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe109⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe110⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe111⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe112⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe113⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe114⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe115⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe116⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe117⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe118⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe119⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe120⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe121⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe122⤵PID:2320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-