Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 04:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe
Resource
win7-20240708-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
3 signatures
150 seconds
General
-
Target
66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe
-
Size
141KB
-
MD5
66145976c936edc89ae6d7bbc1240dc6
-
SHA1
651f84ba7fa2209142d820171b80928e6bbb527c
-
SHA256
7976eb664bdc2fce475a9278abffd4ad0c6e333df333a45a97cf4fbb97c31de7
-
SHA512
ede7211e73dc497c4d52dd3bb0c6b1e07e59ac63378f730abfd94deb141d617d94573a9d607c3ebfe8a6b1cae4e61fd9c67990d48c19aa83676ea2fc2157b95d
-
SSDEEP
3072:wIRbXer8PN9/jLuu4XJuRbYXv2mVy2mw4hgxmnfHvnJR1+aJe1mgawzxsBub861J:tA8PD7XUwRwVy2mw4gxmnfvJRUTV5nH
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2136 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2112 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2096 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2248 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 3056 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2728 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2916 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2612 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2684 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2484 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 680 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 1556 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2872 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2020 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 1796 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 1652 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2864 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 300 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 1820 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2952 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2044 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2244 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2276 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2500 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 3012 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 1620 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 1800 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 1308 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 868 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2496 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2332 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2312 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 1816 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 1852 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 3036 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 1700 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2412 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2360 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2808 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 572 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2516 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2764 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2620 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2772 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 320 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2668 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2916 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2612 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2388 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 552 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 1664 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2004 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 316 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2020 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2124 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 1652 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 340 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 3020 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2944 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2456 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 2072 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 1804 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 920 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe Token: SeDebugPrivilege 1716 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2112 2136 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 30 PID 2136 wrote to memory of 2112 2136 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 30 PID 2136 wrote to memory of 2112 2136 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 30 PID 2112 wrote to memory of 2096 2112 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 31 PID 2112 wrote to memory of 2096 2112 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 31 PID 2112 wrote to memory of 2096 2112 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 31 PID 2096 wrote to memory of 2248 2096 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 32 PID 2096 wrote to memory of 2248 2096 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 32 PID 2096 wrote to memory of 2248 2096 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 32 PID 2248 wrote to memory of 3056 2248 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 33 PID 2248 wrote to memory of 3056 2248 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 33 PID 2248 wrote to memory of 3056 2248 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 33 PID 3056 wrote to memory of 2728 3056 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 34 PID 3056 wrote to memory of 2728 3056 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 34 PID 3056 wrote to memory of 2728 3056 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 34 PID 2728 wrote to memory of 2916 2728 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 35 PID 2728 wrote to memory of 2916 2728 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 35 PID 2728 wrote to memory of 2916 2728 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 35 PID 2916 wrote to memory of 2612 2916 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 36 PID 2916 wrote to memory of 2612 2916 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 36 PID 2916 wrote to memory of 2612 2916 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 36 PID 2612 wrote to memory of 2684 2612 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 37 PID 2612 wrote to memory of 2684 2612 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 37 PID 2612 wrote to memory of 2684 2612 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 37 PID 2684 wrote to memory of 2484 2684 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 38 PID 2684 wrote to memory of 2484 2684 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 38 PID 2684 wrote to memory of 2484 2684 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 38 PID 2484 wrote to memory of 680 2484 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 39 PID 2484 wrote to memory of 680 2484 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 39 PID 2484 wrote to memory of 680 2484 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 39 PID 680 wrote to memory of 1556 680 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 40 PID 680 wrote to memory of 1556 680 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 40 PID 680 wrote to memory of 1556 680 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 40 PID 1556 wrote to memory of 2872 1556 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 41 PID 1556 wrote to memory of 2872 1556 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 41 PID 1556 wrote to memory of 2872 1556 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 41 PID 2872 wrote to memory of 2020 2872 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 42 PID 2872 wrote to memory of 2020 2872 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 42 PID 2872 wrote to memory of 2020 2872 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 42 PID 2020 wrote to memory of 1796 2020 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 43 PID 2020 wrote to memory of 1796 2020 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 43 PID 2020 wrote to memory of 1796 2020 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 43 PID 1796 wrote to memory of 1652 1796 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 44 PID 1796 wrote to memory of 1652 1796 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 44 PID 1796 wrote to memory of 1652 1796 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 44 PID 1652 wrote to memory of 2864 1652 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 45 PID 1652 wrote to memory of 2864 1652 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 45 PID 1652 wrote to memory of 2864 1652 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 45 PID 2864 wrote to memory of 300 2864 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 46 PID 2864 wrote to memory of 300 2864 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 46 PID 2864 wrote to memory of 300 2864 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 46 PID 300 wrote to memory of 1820 300 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 47 PID 300 wrote to memory of 1820 300 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 47 PID 300 wrote to memory of 1820 300 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 47 PID 1820 wrote to memory of 2952 1820 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 48 PID 1820 wrote to memory of 2952 1820 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 48 PID 1820 wrote to memory of 2952 1820 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 48 PID 2952 wrote to memory of 2044 2952 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 49 PID 2952 wrote to memory of 2044 2952 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 49 PID 2952 wrote to memory of 2044 2952 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 49 PID 2044 wrote to memory of 2244 2044 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 50 PID 2044 wrote to memory of 2244 2044 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 50 PID 2044 wrote to memory of 2244 2044 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 50 PID 2244 wrote to memory of 2276 2244 66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe 51
Processes
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe3⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
PID:868 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:572 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:320 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:552 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:316 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:340 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:920 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe65⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe66⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe67⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe68⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe69⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe70⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe71⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe72⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe73⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe74⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe75⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe76⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe77⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe78⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe79⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe80⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe81⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe82⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe83⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe84⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe85⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe86⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe87⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe88⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe89⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe90⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe91⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe92⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe93⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe94⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe95⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe96⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe97⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe98⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe99⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe100⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe101⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe102⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe103⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe104⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe105⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe106⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe107⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe108⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe109⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe110⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe111⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe112⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe113⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe114⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe115⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe116⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe117⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe118⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe119⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe120⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe121⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66145976c936edc89ae6d7bbc1240dc6_JaffaCakes118.exe122⤵PID:2804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-