Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 04:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe
Resource
win7-20240704-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
2 signatures
150 seconds
General
-
Target
8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe
-
Size
70KB
-
MD5
8d41ba58e1be6bc535b411123629671b
-
SHA1
0daf1d1a328b474944f8919ca122a1632155a982
-
SHA256
97fd9f25a088339cb8c72c059eca42c6e944bf05894730736010c6fe07eae390
-
SHA512
dd303f09f106b73a2c47402ebe198305ed4796c4b1e93a69e9e377b61bbb740727b52e85aa3f2980ede6cfbb36711b2b28622e5fcdd8b3ff86cc6b701e150698
-
SSDEEP
1536:/D/NIK3Ugek+xsIOq6tUeF92Ao4l+0nyDmETKvW4J:BLEgWxCZtRF92wVQmeeW4J
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2988 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 964 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 1988 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4468 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 1524 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 1896 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 5000 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 1676 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4208 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 2640 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 5008 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 3844 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4996 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4772 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4980 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4276 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 2292 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 3552 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 2164 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4196 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 3036 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4848 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 3508 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 3492 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4860 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 3988 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 64 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4008 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4656 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4780 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 948 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 968 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 5072 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4252 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 2544 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 1708 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4344 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 2992 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 2144 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 212 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 1452 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 224 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 364 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4512 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 3864 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 2516 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 2304 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 1188 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 2916 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 3216 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 5008 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 2328 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 3532 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 3452 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4116 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4228 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4064 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 684 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 60 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 4804 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 3632 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 3096 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 2820 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe Token: SeDebugPrivilege 5044 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2988 wrote to memory of 964 2988 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 84 PID 2988 wrote to memory of 964 2988 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 84 PID 964 wrote to memory of 1988 964 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 85 PID 964 wrote to memory of 1988 964 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 85 PID 1988 wrote to memory of 4468 1988 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 86 PID 1988 wrote to memory of 4468 1988 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 86 PID 4468 wrote to memory of 1524 4468 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 87 PID 4468 wrote to memory of 1524 4468 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 87 PID 1524 wrote to memory of 1896 1524 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 88 PID 1524 wrote to memory of 1896 1524 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 88 PID 1896 wrote to memory of 5000 1896 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 89 PID 1896 wrote to memory of 5000 1896 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 89 PID 5000 wrote to memory of 1676 5000 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 90 PID 5000 wrote to memory of 1676 5000 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 90 PID 1676 wrote to memory of 4208 1676 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 91 PID 1676 wrote to memory of 4208 1676 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 91 PID 4208 wrote to memory of 2640 4208 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 92 PID 4208 wrote to memory of 2640 4208 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 92 PID 2640 wrote to memory of 5008 2640 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 94 PID 2640 wrote to memory of 5008 2640 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 94 PID 5008 wrote to memory of 3844 5008 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 95 PID 5008 wrote to memory of 3844 5008 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 95 PID 3844 wrote to memory of 4996 3844 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 96 PID 3844 wrote to memory of 4996 3844 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 96 PID 4996 wrote to memory of 4772 4996 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 97 PID 4996 wrote to memory of 4772 4996 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 97 PID 4772 wrote to memory of 4980 4772 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 98 PID 4772 wrote to memory of 4980 4772 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 98 PID 4980 wrote to memory of 4276 4980 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 99 PID 4980 wrote to memory of 4276 4980 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 99 PID 4276 wrote to memory of 2292 4276 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 100 PID 4276 wrote to memory of 2292 4276 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 100 PID 2292 wrote to memory of 3552 2292 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 102 PID 2292 wrote to memory of 3552 2292 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 102 PID 3552 wrote to memory of 2164 3552 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 103 PID 3552 wrote to memory of 2164 3552 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 103 PID 2164 wrote to memory of 4196 2164 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 104 PID 2164 wrote to memory of 4196 2164 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 104 PID 4196 wrote to memory of 3036 4196 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 105 PID 4196 wrote to memory of 3036 4196 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 105 PID 3036 wrote to memory of 4848 3036 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 106 PID 3036 wrote to memory of 4848 3036 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 106 PID 4848 wrote to memory of 3508 4848 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 107 PID 4848 wrote to memory of 3508 4848 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 107 PID 3508 wrote to memory of 3492 3508 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 108 PID 3508 wrote to memory of 3492 3508 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 108 PID 3492 wrote to memory of 4860 3492 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 109 PID 3492 wrote to memory of 4860 3492 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 109 PID 4860 wrote to memory of 3988 4860 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 110 PID 4860 wrote to memory of 3988 4860 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 110 PID 3988 wrote to memory of 64 3988 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 111 PID 3988 wrote to memory of 64 3988 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 111 PID 64 wrote to memory of 4008 64 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 112 PID 64 wrote to memory of 4008 64 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 112 PID 4008 wrote to memory of 4656 4008 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 114 PID 4008 wrote to memory of 4656 4008 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 114 PID 4656 wrote to memory of 4780 4656 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 115 PID 4656 wrote to memory of 4780 4656 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 115 PID 4780 wrote to memory of 948 4780 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 116 PID 4780 wrote to memory of 948 4780 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 116 PID 948 wrote to memory of 968 948 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 117 PID 948 wrote to memory of 968 948 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 117 PID 968 wrote to memory of 5072 968 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 118 PID 968 wrote to memory of 5072 968 8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:212 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:224 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:364 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:684 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:60 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe65⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe66⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe67⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe68⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe69⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe70⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe71⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe72⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe73⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe74⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe75⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe76⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe77⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe78⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe79⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe80⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe81⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe82⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe83⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe84⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe85⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe86⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe87⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe88⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe89⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe90⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe91⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe92⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe93⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe94⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe95⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe96⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe97⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe98⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe99⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe100⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe101⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe102⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe103⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe104⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe105⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe106⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe107⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe108⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe109⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe110⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe111⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe112⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe113⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe114⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe115⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe116⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe117⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe118⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe119⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe120⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe121⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d41ba58e1be6bc535b411123629671b_JaffaCakes118.exe122⤵PID:4584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-