Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 22:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a477ac59389aa2468033701f813c5235_JaffaCakes118.exe
Resource
win7-20240704-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
a477ac59389aa2468033701f813c5235_JaffaCakes118.exe
Resource
win10v2004-20240802-en
2 signatures
150 seconds
General
-
Target
a477ac59389aa2468033701f813c5235_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
a477ac59389aa2468033701f813c5235
-
SHA1
fa4dbec244899daa9e906dc2e85a52c342768079
-
SHA256
ca5a0cd74cfb74262a239e231712466fb5220a6313bbb24bedfe4fc209103a85
-
SHA512
e325fada0de3e2c51c546fbefbb6a917b01c4a06be0d61bf83af25704a36cda15aded6ab8e264a9e7d611189a13cab4342987c0cdcd8345f18e6925c2d7b007a
-
SSDEEP
24576:/tAMUHF8gueq/4XkwkMwAbJVBLylTbrUSzjOLrQyYXHLaw:lAzcg3wAFVmTbrUS+LsBraw
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2928 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 3936 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2068 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2480 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 3520 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 4428 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 3624 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2032 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 64 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 3840 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 4404 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 4256 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 1344 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 4280 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2932 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2492 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2540 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2244 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 5108 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 8 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2796 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 1784 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 5092 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 1532 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 3888 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 3156 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2528 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2916 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 432 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2068 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2480 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2344 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 3712 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 232 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 1768 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 1040 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2404 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2684 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 4692 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2168 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 64 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 3840 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 4404 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 4256 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 1344 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 4280 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 4604 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 4716 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 3448 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 4760 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2540 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 1108 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 1928 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 1772 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 3168 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 228 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 5092 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 1532 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 1496 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 468 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 2152 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 5008 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 412 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe Token: SeDebugPrivilege 400 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2928 wrote to memory of 3936 2928 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 85 PID 2928 wrote to memory of 3936 2928 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 85 PID 3936 wrote to memory of 2068 3936 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 88 PID 3936 wrote to memory of 2068 3936 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 88 PID 2068 wrote to memory of 2480 2068 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 89 PID 2068 wrote to memory of 2480 2068 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 89 PID 2480 wrote to memory of 3520 2480 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 90 PID 2480 wrote to memory of 3520 2480 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 90 PID 3520 wrote to memory of 4428 3520 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 91 PID 3520 wrote to memory of 4428 3520 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 91 PID 4428 wrote to memory of 3624 4428 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 92 PID 4428 wrote to memory of 3624 4428 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 92 PID 3624 wrote to memory of 2032 3624 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 93 PID 3624 wrote to memory of 2032 3624 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 93 PID 2032 wrote to memory of 64 2032 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 94 PID 2032 wrote to memory of 64 2032 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 94 PID 64 wrote to memory of 3840 64 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 95 PID 64 wrote to memory of 3840 64 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 95 PID 3840 wrote to memory of 4404 3840 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 96 PID 3840 wrote to memory of 4404 3840 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 96 PID 4404 wrote to memory of 4256 4404 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 97 PID 4404 wrote to memory of 4256 4404 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 97 PID 4256 wrote to memory of 1344 4256 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 98 PID 4256 wrote to memory of 1344 4256 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 98 PID 1344 wrote to memory of 4280 1344 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 99 PID 1344 wrote to memory of 4280 1344 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 99 PID 4280 wrote to memory of 2932 4280 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 100 PID 4280 wrote to memory of 2932 4280 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 100 PID 2932 wrote to memory of 2492 2932 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 101 PID 2932 wrote to memory of 2492 2932 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 101 PID 2492 wrote to memory of 2540 2492 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 104 PID 2492 wrote to memory of 2540 2492 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 104 PID 2540 wrote to memory of 2244 2540 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 105 PID 2540 wrote to memory of 2244 2540 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 105 PID 2244 wrote to memory of 5108 2244 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 106 PID 2244 wrote to memory of 5108 2244 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 106 PID 5108 wrote to memory of 8 5108 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 107 PID 5108 wrote to memory of 8 5108 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 107 PID 8 wrote to memory of 2796 8 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 108 PID 8 wrote to memory of 2796 8 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 108 PID 2796 wrote to memory of 1784 2796 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 109 PID 2796 wrote to memory of 1784 2796 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 109 PID 1784 wrote to memory of 5092 1784 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 110 PID 1784 wrote to memory of 5092 1784 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 110 PID 5092 wrote to memory of 1532 5092 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 111 PID 5092 wrote to memory of 1532 5092 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 111 PID 1532 wrote to memory of 3888 1532 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 114 PID 1532 wrote to memory of 3888 1532 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 114 PID 3888 wrote to memory of 3156 3888 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 115 PID 3888 wrote to memory of 3156 3888 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 115 PID 3156 wrote to memory of 2528 3156 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 116 PID 3156 wrote to memory of 2528 3156 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 116 PID 2528 wrote to memory of 2916 2528 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 117 PID 2528 wrote to memory of 2916 2528 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 117 PID 2916 wrote to memory of 432 2916 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 118 PID 2916 wrote to memory of 432 2916 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 118 PID 432 wrote to memory of 2068 432 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 119 PID 432 wrote to memory of 2068 432 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 119 PID 2068 wrote to memory of 2480 2068 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 120 PID 2068 wrote to memory of 2480 2068 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 120 PID 2480 wrote to memory of 2344 2480 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 121 PID 2480 wrote to memory of 2344 2480 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 121 PID 2344 wrote to memory of 3712 2344 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 122 PID 2344 wrote to memory of 3712 2344 a477ac59389aa2468033701f813c5235_JaffaCakes118.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:232 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:64 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:228 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:468 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:412 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:400 -
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe65⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe66⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe67⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe68⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe69⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe70⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe71⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe72⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe73⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe74⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe75⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe76⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe77⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe78⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe79⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe80⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe81⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe82⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe83⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe84⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe85⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe86⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe87⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe88⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe89⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe90⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe91⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe92⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe93⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe94⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe95⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe96⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe97⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe98⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe99⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe100⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe101⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe102⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe103⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe104⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe105⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe106⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe107⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe108⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe109⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe110⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe111⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe112⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe113⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe114⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe115⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe116⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe117⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe118⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe119⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe120⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe121⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a477ac59389aa2468033701f813c5235_JaffaCakes118.exe122⤵PID:216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-