Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 08:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe
Resource
win7-20240704-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
3 signatures
150 seconds
General
-
Target
89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe
-
Size
60KB
-
MD5
89c00bf0edc5c97e39a22b24a1b32cb7
-
SHA1
5f1ad79b35868ee328e348e0565d63c7c43a4be2
-
SHA256
8eb70f760aea775485005e9e0583ae13d28378a634214bc21f60c1c6518c1920
-
SHA512
8395edd547d66dd69e4ed44ad820c41679f0cf92c1a01645b4b7fb431b033a1b2929235a02a385db02716c62ae2e8b89c8aff37eacfdef5223a6e8d5fc5e8a8d
-
SSDEEP
1536:xtpXJCIZ3Co1mtFPF3qw3Ds5qPDo19IpMnN/:xvXJ7MEmtFFqkDMqroUpc/
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1448 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 3840 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 4828 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 612 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 2952 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 3460 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 4432 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 4972 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 4940 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1680 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 464 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 2700 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 4680 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 4100 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 4776 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 3696 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 4224 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1328 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1376 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 2696 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 4144 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1200 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 4172 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 2996 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 2236 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 4288 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 64 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1460 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1896 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 220 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 3612 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 3312 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 3980 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 3944 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 3416 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 2992 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 2028 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1228 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 2648 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1512 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 2572 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1212 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 2344 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 800 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1180 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1156 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 3852 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1444 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1148 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1696 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1292 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 784 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 3388 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 2624 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 2292 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 60 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 3976 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 3592 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 2064 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 3044 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1896 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 3396 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 1056 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe Token: SeDebugPrivilege 3512 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1448 wrote to memory of 3840 1448 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 84 PID 1448 wrote to memory of 3840 1448 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 84 PID 3840 wrote to memory of 4828 3840 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 85 PID 3840 wrote to memory of 4828 3840 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 85 PID 4828 wrote to memory of 612 4828 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 86 PID 4828 wrote to memory of 612 4828 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 86 PID 612 wrote to memory of 2952 612 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 87 PID 612 wrote to memory of 2952 612 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 87 PID 2952 wrote to memory of 3460 2952 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 88 PID 2952 wrote to memory of 3460 2952 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 88 PID 3460 wrote to memory of 4432 3460 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 90 PID 3460 wrote to memory of 4432 3460 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 90 PID 4432 wrote to memory of 4972 4432 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 91 PID 4432 wrote to memory of 4972 4432 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 91 PID 4972 wrote to memory of 4940 4972 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 92 PID 4972 wrote to memory of 4940 4972 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 92 PID 4940 wrote to memory of 1680 4940 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 93 PID 4940 wrote to memory of 1680 4940 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 93 PID 1680 wrote to memory of 464 1680 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 94 PID 1680 wrote to memory of 464 1680 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 94 PID 464 wrote to memory of 2700 464 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 96 PID 464 wrote to memory of 2700 464 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 96 PID 2700 wrote to memory of 4680 2700 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 98 PID 2700 wrote to memory of 4680 2700 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 98 PID 4680 wrote to memory of 4100 4680 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 99 PID 4680 wrote to memory of 4100 4680 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 99 PID 4100 wrote to memory of 4776 4100 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 100 PID 4100 wrote to memory of 4776 4100 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 100 PID 4776 wrote to memory of 3696 4776 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 101 PID 4776 wrote to memory of 3696 4776 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 101 PID 3696 wrote to memory of 4224 3696 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 102 PID 3696 wrote to memory of 4224 3696 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 102 PID 4224 wrote to memory of 1328 4224 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 103 PID 4224 wrote to memory of 1328 4224 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 103 PID 1328 wrote to memory of 1376 1328 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 104 PID 1328 wrote to memory of 1376 1328 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 104 PID 1376 wrote to memory of 2696 1376 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 105 PID 1376 wrote to memory of 2696 1376 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 105 PID 2696 wrote to memory of 4144 2696 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 106 PID 2696 wrote to memory of 4144 2696 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 106 PID 4144 wrote to memory of 1200 4144 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 107 PID 4144 wrote to memory of 1200 4144 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 107 PID 1200 wrote to memory of 4172 1200 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 108 PID 1200 wrote to memory of 4172 1200 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 108 PID 4172 wrote to memory of 2996 4172 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 109 PID 4172 wrote to memory of 2996 4172 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 109 PID 2996 wrote to memory of 2236 2996 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 110 PID 2996 wrote to memory of 2236 2996 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 110 PID 2236 wrote to memory of 4288 2236 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 111 PID 2236 wrote to memory of 4288 2236 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 111 PID 4288 wrote to memory of 64 4288 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 112 PID 4288 wrote to memory of 64 4288 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 112 PID 64 wrote to memory of 1460 64 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 113 PID 64 wrote to memory of 1460 64 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 113 PID 1460 wrote to memory of 1896 1460 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 114 PID 1460 wrote to memory of 1896 1460 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 114 PID 1896 wrote to memory of 220 1896 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 117 PID 1896 wrote to memory of 220 1896 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 117 PID 220 wrote to memory of 3612 220 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 118 PID 220 wrote to memory of 3612 220 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 118 PID 3612 wrote to memory of 3312 3612 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 119 PID 3612 wrote to memory of 3312 3612 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 119 PID 3312 wrote to memory of 3980 3312 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 120 PID 3312 wrote to memory of 3980 3312 89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:800 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:784 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:60 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe65⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe66⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe67⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe68⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe69⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe70⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe71⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe72⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe73⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe74⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe75⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe76⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe77⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe78⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe79⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe80⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe81⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe82⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe83⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe84⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe85⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe86⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe87⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe88⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe89⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe90⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe91⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe92⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe93⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe94⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe95⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe96⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe97⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe98⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe99⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe100⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe101⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe102⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe103⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe104⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe105⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe106⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe107⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe108⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe109⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe110⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe111⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe112⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe113⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe114⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe115⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe116⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe117⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe118⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe119⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe120⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe121⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\89c00bf0edc5c97e39a22b24a1b32cb7_JaffaCakes118.exe122⤵PID:696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-