Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 07:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe
Resource
win7-20240704-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
2 signatures
150 seconds
General
-
Target
8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe
-
Size
56KB
-
MD5
8df0fdba143d89ae07a8e2acc6868f0a
-
SHA1
5996a6957387be23d7057d3bd81db40434c974e5
-
SHA256
4bb83f11712122391f904d20b395f70f0ae774261a2883c67da0c0dadea4f8f7
-
SHA512
664eaaac4e3fc0c98d16a7511f6a7a49af92be1f487e912fa50a53f42e7abeb490952d20b878a13e655d5d40901eeb48e3428d9815d0a1f546bfb6a5141c5b29
-
SSDEEP
1536:PO+3jUFr0EFr84Tol7BAZsSh1SaFucJo0y3Mia:W+3jW0ENTULAZsC1jj
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4528 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4788 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 3400 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2228 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4688 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2660 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2704 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2500 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4060 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1252 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 3136 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 680 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 5072 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 3024 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4520 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4772 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4080 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4252 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4932 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1884 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 3660 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 3048 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4340 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4424 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 3984 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2180 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2292 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 3908 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4452 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4068 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 3380 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 184 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4492 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1564 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4556 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 3400 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4688 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2820 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2660 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2672 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1484 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 32 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4884 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2044 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 3276 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 796 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 3260 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1604 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1260 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 628 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4564 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 3932 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2352 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2544 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1788 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1324 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 2944 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 5116 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1772 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 5020 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 3164 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 1112 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 3300 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe Token: SeDebugPrivilege 4976 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4528 wrote to memory of 4788 4528 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 84 PID 4528 wrote to memory of 4788 4528 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 84 PID 4788 wrote to memory of 3400 4788 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 85 PID 4788 wrote to memory of 3400 4788 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 85 PID 3400 wrote to memory of 2228 3400 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 86 PID 3400 wrote to memory of 2228 3400 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 86 PID 2228 wrote to memory of 4688 2228 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 87 PID 2228 wrote to memory of 4688 2228 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 87 PID 4688 wrote to memory of 2660 4688 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 88 PID 4688 wrote to memory of 2660 4688 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 88 PID 2660 wrote to memory of 2704 2660 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 89 PID 2660 wrote to memory of 2704 2660 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 89 PID 2704 wrote to memory of 2500 2704 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 90 PID 2704 wrote to memory of 2500 2704 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 90 PID 2500 wrote to memory of 4060 2500 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 92 PID 2500 wrote to memory of 4060 2500 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 92 PID 4060 wrote to memory of 1252 4060 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 93 PID 4060 wrote to memory of 1252 4060 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 93 PID 1252 wrote to memory of 3136 1252 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 96 PID 1252 wrote to memory of 3136 1252 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 96 PID 3136 wrote to memory of 680 3136 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 97 PID 3136 wrote to memory of 680 3136 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 97 PID 680 wrote to memory of 5072 680 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 98 PID 680 wrote to memory of 5072 680 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 98 PID 5072 wrote to memory of 3024 5072 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 99 PID 5072 wrote to memory of 3024 5072 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 99 PID 3024 wrote to memory of 4520 3024 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 101 PID 3024 wrote to memory of 4520 3024 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 101 PID 4520 wrote to memory of 4772 4520 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 103 PID 4520 wrote to memory of 4772 4520 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 103 PID 4772 wrote to memory of 4080 4772 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 104 PID 4772 wrote to memory of 4080 4772 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 104 PID 4080 wrote to memory of 4252 4080 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 105 PID 4080 wrote to memory of 4252 4080 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 105 PID 4252 wrote to memory of 4932 4252 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 106 PID 4252 wrote to memory of 4932 4252 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 106 PID 4932 wrote to memory of 1884 4932 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 107 PID 4932 wrote to memory of 1884 4932 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 107 PID 1884 wrote to memory of 3660 1884 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 108 PID 1884 wrote to memory of 3660 1884 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 108 PID 3660 wrote to memory of 3048 3660 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 109 PID 3660 wrote to memory of 3048 3660 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 109 PID 3048 wrote to memory of 4340 3048 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 110 PID 3048 wrote to memory of 4340 3048 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 110 PID 4340 wrote to memory of 4424 4340 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 112 PID 4340 wrote to memory of 4424 4340 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 112 PID 4424 wrote to memory of 3984 4424 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 114 PID 4424 wrote to memory of 3984 4424 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 114 PID 3984 wrote to memory of 2180 3984 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 115 PID 3984 wrote to memory of 2180 3984 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 115 PID 2180 wrote to memory of 2292 2180 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 116 PID 2180 wrote to memory of 2292 2180 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 116 PID 2292 wrote to memory of 3908 2292 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 117 PID 2292 wrote to memory of 3908 2292 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 117 PID 3908 wrote to memory of 4452 3908 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 118 PID 3908 wrote to memory of 4452 3908 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 118 PID 4452 wrote to memory of 4068 4452 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 119 PID 4452 wrote to memory of 4068 4452 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 119 PID 4068 wrote to memory of 3380 4068 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 120 PID 4068 wrote to memory of 3380 4068 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 120 PID 3380 wrote to memory of 184 3380 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 121 PID 3380 wrote to memory of 184 3380 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 121 PID 184 wrote to memory of 4492 184 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 122 PID 184 wrote to memory of 4492 184 8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:184 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:32 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:796 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:628 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe65⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe66⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe67⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe68⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe69⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe70⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe71⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe72⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe73⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe74⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe75⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe76⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe77⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe78⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe79⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe80⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe81⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe82⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe83⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe84⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe85⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe86⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe87⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe88⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe89⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe90⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe91⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe92⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe93⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe94⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe95⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe96⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe97⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe98⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe99⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe100⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe101⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe102⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe103⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe104⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe105⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe106⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe107⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe108⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe109⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe110⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe111⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe112⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe113⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe114⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe115⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe116⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe117⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe118⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe119⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe120⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe121⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8df0fdba143d89ae07a8e2acc6868f0a_JaffaCakes118.exe122⤵PID:2292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-