Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 07:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe
Resource
win7-20240704-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
2 signatures
150 seconds
General
-
Target
8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe
-
Size
56KB
-
MD5
8df0fdba143d89ae07a8e2acc6868f0a
-
SHA1
5996a6957387be23d7057d3bd81db40434c974e5
-
SHA256
4bb83f11712122391f904d20b395f70f0ae774261a2883c67da0c0dadea4f8f7
-
SHA512
664eaaac4e3fc0c98d16a7511f6a7a49af92be1f487e912fa50a53f42e7abeb490952d20b878a13e655d5d40901eeb48e3428d9815d0a1f546bfb6a5141c5b29
-
SSDEEP
1536:PO+3jUFr0EFr84Tol7BAZsSh1SaFucJo0y3Mia:W+3jW0ENTULAZsC1jj
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 468 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1908 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 3000 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2632 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2684 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2784 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2668 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2896 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2864 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2796 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2560 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2980 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2056 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 788 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1444 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1636 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1616 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2440 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1600 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1548 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1684 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2780 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2412 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2096 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2392 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1188 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2872 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1536 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1364 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1936 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 564 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 292 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2500 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2932 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2268 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2516 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1428 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 628 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1524 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2952 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2888 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2172 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2752 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2736 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2756 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2696 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2576 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2812 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2552 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2612 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2664 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2804 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2288 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2284 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1736 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2036 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 356 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1068 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2440 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1600 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 956 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2956 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 820 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2400 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 468 wrote to memory of 1908 468 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 31 PID 468 wrote to memory of 1908 468 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 31 PID 468 wrote to memory of 1908 468 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 31 PID 1908 wrote to memory of 3000 1908 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 32 PID 1908 wrote to memory of 3000 1908 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 32 PID 1908 wrote to memory of 3000 1908 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 32 PID 3000 wrote to memory of 2632 3000 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 33 PID 3000 wrote to memory of 2632 3000 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 33 PID 3000 wrote to memory of 2632 3000 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 33 PID 2632 wrote to memory of 2684 2632 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 34 PID 2632 wrote to memory of 2684 2632 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 34 PID 2632 wrote to memory of 2684 2632 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 34 PID 2684 wrote to memory of 2784 2684 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 35 PID 2684 wrote to memory of 2784 2684 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 35 PID 2684 wrote to memory of 2784 2684 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 35 PID 2784 wrote to memory of 2668 2784 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 36 PID 2784 wrote to memory of 2668 2784 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 36 PID 2784 wrote to memory of 2668 2784 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 36 PID 2668 wrote to memory of 2896 2668 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 37 PID 2668 wrote to memory of 2896 2668 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 37 PID 2668 wrote to memory of 2896 2668 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 37 PID 2896 wrote to memory of 2864 2896 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 38 PID 2896 wrote to memory of 2864 2896 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 38 PID 2896 wrote to memory of 2864 2896 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 38 PID 2864 wrote to memory of 2796 2864 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 39 PID 2864 wrote to memory of 2796 2864 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 39 PID 2864 wrote to memory of 2796 2864 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 39 PID 2796 wrote to memory of 2560 2796 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 40 PID 2796 wrote to memory of 2560 2796 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 40 PID 2796 wrote to memory of 2560 2796 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 40 PID 2560 wrote to memory of 2980 2560 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 41 PID 2560 wrote to memory of 2980 2560 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 41 PID 2560 wrote to memory of 2980 2560 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 41 PID 2980 wrote to memory of 2056 2980 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 42 PID 2980 wrote to memory of 2056 2980 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 42 PID 2980 wrote to memory of 2056 2980 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 42 PID 2056 wrote to memory of 788 2056 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 43 PID 2056 wrote to memory of 788 2056 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 43 PID 2056 wrote to memory of 788 2056 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 43 PID 788 wrote to memory of 1444 788 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 44 PID 788 wrote to memory of 1444 788 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 44 PID 788 wrote to memory of 1444 788 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 44 PID 1444 wrote to memory of 1636 1444 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 45 PID 1444 wrote to memory of 1636 1444 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 45 PID 1444 wrote to memory of 1636 1444 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 45 PID 1636 wrote to memory of 1616 1636 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 46 PID 1636 wrote to memory of 1616 1636 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 46 PID 1636 wrote to memory of 1616 1636 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 46 PID 1616 wrote to memory of 2440 1616 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 47 PID 1616 wrote to memory of 2440 1616 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 47 PID 1616 wrote to memory of 2440 1616 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 47 PID 2440 wrote to memory of 1600 2440 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 48 PID 2440 wrote to memory of 1600 2440 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 48 PID 2440 wrote to memory of 1600 2440 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 48 PID 1600 wrote to memory of 1548 1600 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 49 PID 1600 wrote to memory of 1548 1600 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 49 PID 1600 wrote to memory of 1548 1600 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 49 PID 1548 wrote to memory of 1684 1548 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 50 PID 1548 wrote to memory of 1684 1548 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 50 PID 1548 wrote to memory of 1684 1548 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 50 PID 1684 wrote to memory of 2780 1684 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 51 PID 1684 wrote to memory of 2780 1684 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 51 PID 1684 wrote to memory of 2780 1684 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 51 PID 2780 wrote to memory of 2412 2780 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
PID:564 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
PID:292 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:628 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:356 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:956 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:820 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe65⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe66⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe67⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe68⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe69⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe70⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe71⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe72⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe73⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe74⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe75⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe76⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe77⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe78⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe79⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe80⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe81⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe82⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe83⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe84⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe85⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe86⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe87⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe88⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe89⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe90⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe91⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe92⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe93⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe94⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe95⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe96⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe97⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe98⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe99⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe100⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe101⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe102⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe103⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe104⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe105⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe106⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe107⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe108⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe109⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe110⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe111⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe112⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe113⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe114⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe115⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe116⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe117⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe118⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe119⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe120⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe121⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe122⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-