Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 09:03
Static task
static1
Behavioral task
behavioral1
Sample
66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe
-
Size
86KB
-
MD5
66ef74ceab4d4b9fe9853c81d91d8223
-
SHA1
d8834d4fa02a17547ae037d803fe766cb9fcf0df
-
SHA256
6778413cda36259c34febc565b8c18fd5a1e6f1c8fbc1c5bda095aaca1de0e68
-
SHA512
6ec2974455fafc77ebbf087da6c9d6b64a169c89872ec30d94a9a9abbd883f2646a9d69f93bc3ee7a28def826416a6fa1ea25ad606758e74f79b6260bbe7cd24
-
SSDEEP
1536:chPn6C9YhdFIeCYegHWjw2cGHQw5D8HafdUafd4sDCQZ58ZGIaAriCE:86C4FkYerjXck5D8HafOafasDh5nxf
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4572 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2964 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4468 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4956 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 3148 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1312 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 220 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4160 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4164 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2624 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4632 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 652 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2472 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4360 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 5020 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1932 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2592 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 848 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 3924 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4744 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2776 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4864 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 3476 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4248 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4000 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4896 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2752 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4272 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 3620 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4512 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 744 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 3624 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1492 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4332 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 3640 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1552 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2824 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2608 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 5004 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4628 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4468 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 932 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 3644 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 936 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4912 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4384 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2352 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2788 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2624 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 216 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4588 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2128 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1608 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 3480 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2408 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 1332 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 3656 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 3444 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 4848 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2948 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 3412 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 376 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 2916 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe Token: SeDebugPrivilege 3312 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4572 wrote to memory of 2964 4572 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 84 PID 4572 wrote to memory of 2964 4572 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 84 PID 2964 wrote to memory of 4468 2964 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 85 PID 2964 wrote to memory of 4468 2964 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 85 PID 4468 wrote to memory of 4956 4468 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 86 PID 4468 wrote to memory of 4956 4468 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 86 PID 4956 wrote to memory of 3148 4956 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 87 PID 4956 wrote to memory of 3148 4956 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 87 PID 3148 wrote to memory of 1312 3148 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 88 PID 3148 wrote to memory of 1312 3148 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 88 PID 1312 wrote to memory of 220 1312 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 90 PID 1312 wrote to memory of 220 1312 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 90 PID 220 wrote to memory of 4160 220 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 91 PID 220 wrote to memory of 4160 220 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 91 PID 4160 wrote to memory of 4164 4160 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 92 PID 4160 wrote to memory of 4164 4160 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 92 PID 4164 wrote to memory of 2624 4164 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 93 PID 4164 wrote to memory of 2624 4164 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 93 PID 2624 wrote to memory of 4632 2624 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 95 PID 2624 wrote to memory of 4632 2624 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 95 PID 4632 wrote to memory of 652 4632 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 96 PID 4632 wrote to memory of 652 4632 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 96 PID 652 wrote to memory of 2472 652 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 98 PID 652 wrote to memory of 2472 652 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 98 PID 2472 wrote to memory of 4360 2472 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 99 PID 2472 wrote to memory of 4360 2472 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 99 PID 4360 wrote to memory of 5020 4360 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 100 PID 4360 wrote to memory of 5020 4360 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 100 PID 5020 wrote to memory of 1932 5020 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 101 PID 5020 wrote to memory of 1932 5020 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 101 PID 1932 wrote to memory of 2592 1932 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 102 PID 1932 wrote to memory of 2592 1932 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 102 PID 2592 wrote to memory of 848 2592 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 103 PID 2592 wrote to memory of 848 2592 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 103 PID 848 wrote to memory of 3924 848 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 104 PID 848 wrote to memory of 3924 848 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 104 PID 3924 wrote to memory of 4744 3924 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 105 PID 3924 wrote to memory of 4744 3924 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 105 PID 4744 wrote to memory of 2776 4744 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 106 PID 4744 wrote to memory of 2776 4744 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 106 PID 2776 wrote to memory of 4864 2776 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 107 PID 2776 wrote to memory of 4864 2776 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 107 PID 4864 wrote to memory of 3476 4864 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 108 PID 4864 wrote to memory of 3476 4864 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 108 PID 3476 wrote to memory of 4248 3476 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 109 PID 3476 wrote to memory of 4248 3476 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 109 PID 4248 wrote to memory of 4000 4248 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 110 PID 4248 wrote to memory of 4000 4248 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 110 PID 4000 wrote to memory of 4896 4000 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 111 PID 4000 wrote to memory of 4896 4000 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 111 PID 4896 wrote to memory of 2752 4896 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 112 PID 4896 wrote to memory of 2752 4896 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 112 PID 2752 wrote to memory of 4272 2752 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 113 PID 2752 wrote to memory of 4272 2752 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 113 PID 4272 wrote to memory of 3620 4272 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 114 PID 4272 wrote to memory of 3620 4272 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 114 PID 3620 wrote to memory of 4512 3620 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 115 PID 3620 wrote to memory of 4512 3620 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 115 PID 4512 wrote to memory of 744 4512 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 116 PID 4512 wrote to memory of 744 4512 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 116 PID 744 wrote to memory of 3624 744 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 117 PID 744 wrote to memory of 3624 744 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 117 PID 3624 wrote to memory of 1492 3624 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 118 PID 3624 wrote to memory of 1492 3624 66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:932 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:936 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:216 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:376 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe65⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe66⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe67⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe68⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe69⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe70⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe71⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe72⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe73⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe74⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe75⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe76⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe77⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe78⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe79⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe80⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe81⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe82⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe83⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe84⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe85⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe86⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe87⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe88⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe89⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe90⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe91⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe92⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe93⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe94⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe95⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe96⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe97⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe98⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe99⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe100⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe101⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe102⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe103⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe104⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe105⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe106⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe107⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe108⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe109⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe110⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe111⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe112⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe113⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe114⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe115⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe116⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe117⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe118⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe119⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe120⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe121⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66ef74ceab4d4b9fe9853c81d91d8223_JaffaCakes118.exe122⤵PID:4420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-