Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2024 03:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe
-
Size
57KB
-
MD5
5a5a568226efbf58bb3f015dba25682b
-
SHA1
2798118b8b18257b2dac1109b7e26ff66ed26d27
-
SHA256
d90881ca5829f50289c4c7ba3272537ef44c8ace1cc34fbf9310f2958dfb0f06
-
SHA512
d11d2e09733064ca7fc30044d01093132542220feae6baa72b0f0c922ec39679c2d05869ae6292b827a2445637484314e63976554aae282d088a05cb00635f21
-
SSDEEP
1536:Zfc3Sm5lJL8J5OqF/fg4mnGg+0D4yby5p1AO81:LmDJoVf/+b4rb1N81
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4384 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 4460 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2888 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 4380 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2752 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 4784 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1292 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2336 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3268 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 216 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3532 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1524 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 912 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3508 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 5096 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 5064 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2040 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1096 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 4304 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2384 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 4832 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2580 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1500 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 4044 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 8 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 5048 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2712 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3368 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1804 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3684 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 372 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1440 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 628 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2196 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3100 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 4556 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2912 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 4120 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 4660 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 4972 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1444 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3664 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1556 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 4780 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2428 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 320 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 540 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2444 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 916 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1412 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3816 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2868 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2748 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 4016 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 2384 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 4832 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3416 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3676 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 5040 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 8 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 5048 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1260 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 1396 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe Token: SeDebugPrivilege 3240 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4384 wrote to memory of 4460 4384 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 84 PID 4384 wrote to memory of 4460 4384 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 84 PID 4460 wrote to memory of 2888 4460 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 85 PID 4460 wrote to memory of 2888 4460 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 85 PID 2888 wrote to memory of 4380 2888 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 86 PID 2888 wrote to memory of 4380 2888 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 86 PID 4380 wrote to memory of 2752 4380 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 87 PID 4380 wrote to memory of 2752 4380 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 87 PID 2752 wrote to memory of 4784 2752 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 88 PID 2752 wrote to memory of 4784 2752 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 88 PID 4784 wrote to memory of 1292 4784 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 89 PID 4784 wrote to memory of 1292 4784 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 89 PID 1292 wrote to memory of 2336 1292 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 90 PID 1292 wrote to memory of 2336 1292 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 90 PID 2336 wrote to memory of 3268 2336 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 91 PID 2336 wrote to memory of 3268 2336 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 91 PID 3268 wrote to memory of 216 3268 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 92 PID 3268 wrote to memory of 216 3268 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 92 PID 216 wrote to memory of 3532 216 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 93 PID 216 wrote to memory of 3532 216 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 93 PID 3532 wrote to memory of 1524 3532 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 94 PID 3532 wrote to memory of 1524 3532 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 94 PID 1524 wrote to memory of 912 1524 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 95 PID 1524 wrote to memory of 912 1524 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 95 PID 912 wrote to memory of 3508 912 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 96 PID 912 wrote to memory of 3508 912 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 96 PID 3508 wrote to memory of 5096 3508 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 98 PID 3508 wrote to memory of 5096 3508 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 98 PID 5096 wrote to memory of 5064 5096 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 100 PID 5096 wrote to memory of 5064 5096 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 100 PID 5064 wrote to memory of 2040 5064 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 101 PID 5064 wrote to memory of 2040 5064 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 101 PID 2040 wrote to memory of 1096 2040 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 102 PID 2040 wrote to memory of 1096 2040 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 102 PID 1096 wrote to memory of 4304 1096 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 103 PID 1096 wrote to memory of 4304 1096 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 103 PID 4304 wrote to memory of 2384 4304 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 104 PID 4304 wrote to memory of 2384 4304 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 104 PID 2384 wrote to memory of 4832 2384 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 105 PID 2384 wrote to memory of 4832 2384 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 105 PID 4832 wrote to memory of 2580 4832 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 106 PID 4832 wrote to memory of 2580 4832 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 106 PID 2580 wrote to memory of 1500 2580 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 107 PID 2580 wrote to memory of 1500 2580 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 107 PID 1500 wrote to memory of 4044 1500 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 108 PID 1500 wrote to memory of 4044 1500 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 108 PID 4044 wrote to memory of 8 4044 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 109 PID 4044 wrote to memory of 8 4044 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 109 PID 8 wrote to memory of 5048 8 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 112 PID 8 wrote to memory of 5048 8 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 112 PID 5048 wrote to memory of 2712 5048 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 113 PID 5048 wrote to memory of 2712 5048 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 113 PID 2712 wrote to memory of 3368 2712 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 114 PID 2712 wrote to memory of 3368 2712 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 114 PID 3368 wrote to memory of 1804 3368 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 115 PID 3368 wrote to memory of 1804 3368 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 115 PID 1804 wrote to memory of 3684 1804 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 116 PID 1804 wrote to memory of 3684 1804 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 116 PID 3684 wrote to memory of 372 3684 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 118 PID 3684 wrote to memory of 372 3684 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 118 PID 372 wrote to memory of 1440 372 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 119 PID 372 wrote to memory of 1440 372 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 119 PID 1440 wrote to memory of 628 1440 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 120 PID 1440 wrote to memory of 628 1440 5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:628 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:320 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:540 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:916 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:8 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe65⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe66⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe67⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe68⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe69⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe70⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe71⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe72⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe73⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe74⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe75⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe76⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe77⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe78⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe79⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe80⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe81⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe82⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe83⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe84⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe85⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe86⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe87⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe88⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe89⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe90⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe91⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe92⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe93⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe94⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe95⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe96⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe97⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe98⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe99⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe100⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe101⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe102⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe103⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe104⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe105⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe106⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe107⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe108⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe109⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe110⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe111⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe112⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe113⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe114⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe115⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe116⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe117⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe118⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe119⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe120⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe121⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5a5a568226efbf58bb3f015dba25682b_JaffaCakes118.exe122⤵PID:3852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-