Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 09:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe
-
Size
86KB
-
MD5
66ef74ceab4d4b9fe9853c81d91d8223
-
SHA1
d8834d4fa02a17547ae037d803fe766cb9fcf0df
-
SHA256
6778413cda36259c34febc565b8c18fd5a1e6f1c8fbc1c5bda095aaca1de0e68
-
SHA512
6ec2974455fafc77ebbf087da6c9d6b64a169c89872ec30d94a9a9abbd883f2646a9d69f93bc3ee7a28def826416a6fa1ea25ad606758e74f79b6260bbe7cd24
-
SSDEEP
1536:chPn6C9YhdFIeCYegHWjw2cGHQw5D8HafdUafd4sDCQZ58ZGIaAriCE:86C4FkYerjXck5D8HafOafasDh5nxf
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2884 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2404 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2760 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 3040 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2620 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2880 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2032 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2668 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2664 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2844 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2592 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2568 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2472 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1568 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1564 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2956 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2928 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1272 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 884 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1324 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2036 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2108 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2232 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2296 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2388 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1728 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 560 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1488 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1672 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 528 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 820 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1908 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1688 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1016 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1252 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1916 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 704 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2012 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 868 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2556 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1556 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2424 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2804 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2764 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2408 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2648 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2840 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2616 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2656 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2060 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2596 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2476 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1700 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2328 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2944 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2972 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2872 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1280 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1364 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 640 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1356 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2252 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2264 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2180 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2404 2884 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 29 PID 2884 wrote to memory of 2404 2884 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 29 PID 2884 wrote to memory of 2404 2884 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 29 PID 2404 wrote to memory of 2760 2404 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 30 PID 2404 wrote to memory of 2760 2404 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 30 PID 2404 wrote to memory of 2760 2404 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 30 PID 2760 wrote to memory of 3040 2760 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 31 PID 2760 wrote to memory of 3040 2760 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 31 PID 2760 wrote to memory of 3040 2760 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 31 PID 3040 wrote to memory of 2620 3040 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 32 PID 3040 wrote to memory of 2620 3040 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 32 PID 3040 wrote to memory of 2620 3040 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 32 PID 2620 wrote to memory of 2880 2620 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 33 PID 2620 wrote to memory of 2880 2620 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 33 PID 2620 wrote to memory of 2880 2620 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 33 PID 2880 wrote to memory of 2032 2880 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 34 PID 2880 wrote to memory of 2032 2880 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 34 PID 2880 wrote to memory of 2032 2880 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 34 PID 2032 wrote to memory of 2668 2032 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 35 PID 2032 wrote to memory of 2668 2032 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 35 PID 2032 wrote to memory of 2668 2032 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 35 PID 2668 wrote to memory of 2664 2668 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 36 PID 2668 wrote to memory of 2664 2668 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 36 PID 2668 wrote to memory of 2664 2668 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 36 PID 2664 wrote to memory of 2844 2664 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 37 PID 2664 wrote to memory of 2844 2664 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 37 PID 2664 wrote to memory of 2844 2664 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 37 PID 2844 wrote to memory of 2592 2844 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 38 PID 2844 wrote to memory of 2592 2844 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 38 PID 2844 wrote to memory of 2592 2844 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 38 PID 2592 wrote to memory of 2568 2592 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 39 PID 2592 wrote to memory of 2568 2592 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 39 PID 2592 wrote to memory of 2568 2592 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 39 PID 2568 wrote to memory of 2472 2568 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 40 PID 2568 wrote to memory of 2472 2568 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 40 PID 2568 wrote to memory of 2472 2568 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 40 PID 2472 wrote to memory of 1568 2472 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 41 PID 2472 wrote to memory of 1568 2472 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 41 PID 2472 wrote to memory of 1568 2472 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 41 PID 1568 wrote to memory of 1564 1568 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 42 PID 1568 wrote to memory of 1564 1568 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 42 PID 1568 wrote to memory of 1564 1568 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 42 PID 1564 wrote to memory of 2956 1564 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 43 PID 1564 wrote to memory of 2956 1564 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 43 PID 1564 wrote to memory of 2956 1564 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 43 PID 2956 wrote to memory of 2928 2956 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 44 PID 2956 wrote to memory of 2928 2956 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 44 PID 2956 wrote to memory of 2928 2956 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 44 PID 2928 wrote to memory of 1272 2928 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 45 PID 2928 wrote to memory of 1272 2928 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 45 PID 2928 wrote to memory of 1272 2928 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 45 PID 1272 wrote to memory of 884 1272 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 46 PID 1272 wrote to memory of 884 1272 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 46 PID 1272 wrote to memory of 884 1272 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 46 PID 884 wrote to memory of 1324 884 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 47 PID 884 wrote to memory of 1324 884 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 47 PID 884 wrote to memory of 1324 884 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 47 PID 1324 wrote to memory of 2036 1324 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 48 PID 1324 wrote to memory of 2036 1324 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 48 PID 1324 wrote to memory of 2036 1324 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 48 PID 2036 wrote to memory of 2108 2036 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 49 PID 2036 wrote to memory of 2108 2036 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 49 PID 2036 wrote to memory of 2108 2036 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 49 PID 2108 wrote to memory of 2232 2108 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 50
Processes
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
PID:560 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
PID:528 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
PID:820 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:704 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:868 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:640 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe65⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe66⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe67⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe68⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe69⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe70⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe71⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe72⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe73⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe74⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe75⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe76⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe77⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe78⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe79⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe80⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe81⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe82⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe83⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe84⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe85⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe86⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe87⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe88⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe89⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe90⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe91⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe92⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe93⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe94⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe95⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe96⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe97⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe98⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe99⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe100⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe101⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe102⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe103⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe104⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe105⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe106⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe107⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe108⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe109⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe110⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe111⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe112⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe113⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe114⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe115⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe116⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe117⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe118⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe119⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe120⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe121⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe122⤵PID:1664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-