Analysis
-
max time kernel
132s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 13:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe
Resource
win7-20240729-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe
Resource
win10v2004-20240802-en
2 signatures
150 seconds
General
-
Target
ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe
-
Size
455KB
-
MD5
ab36e42286bec0e96c6a7cb11c134c74
-
SHA1
ee91cf499cf550956ab7d677a70fd97ca48c1f34
-
SHA256
a69725521781060c1f4119317845e8f05c9970f96682d3f410eb304639188dae
-
SHA512
4f5bde9e158116ad745b7e078903ff1dffe64f625541a333141503b278b40c0c9bd2164862f9ffd41996e5135f15fbb292d9ec556cf0209f775224cf3a461bd1
-
SSDEEP
6144:rQ7Je3kdW3kdFZM6t/60EFe+ng3HLylpEddI26PedfNljUIpLejqf:87JPnrmF3yWnM36Pijp6j+
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 3036 set thread context of 2128 3036 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 31 PID 2128 set thread context of 2940 2128 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 33 PID 2940 set thread context of 2908 2940 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 35 PID 2908 set thread context of 2760 2908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 37 PID 2760 set thread context of 1908 2760 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 39 PID 1908 set thread context of 1656 1908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 41 PID 1656 set thread context of 2504 1656 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 43 PID 2504 set thread context of 1268 2504 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 45 PID 1268 set thread context of 2708 1268 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 218 PID 2708 set thread context of 2332 2708 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 130 PID 2332 set thread context of 1444 2332 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 51 PID 1444 set thread context of 1696 1444 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 53 PID 1696 set thread context of 2200 1696 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 305 PID 2200 set thread context of 3068 2200 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 101 PID 3068 set thread context of 1132 3068 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 102 PID 1132 set thread context of 768 1132 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 140 PID 768 set thread context of 1740 768 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 63 PID 1740 set thread context of 2412 1740 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 143 PID 2412 set thread context of 2232 2412 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 67 PID 2232 set thread context of 2284 2232 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 69 PID 2284 set thread context of 744 2284 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 180 PID 744 set thread context of 1584 744 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 300 PID 1584 set thread context of 2748 1584 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 183 PID 2748 set thread context of 2516 2748 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 184 PID 2516 set thread context of 1756 2516 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 120 PID 1756 set thread context of 2376 1756 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 81 PID 2376 set thread context of 2728 2376 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 288 PID 2728 set thread context of 2964 2728 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 85 PID 2964 set thread context of 2508 2964 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 279 PID 2508 set thread context of 568 2508 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 89 PID 568 set thread context of 1712 568 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 131 PID 1712 set thread context of 2620 1712 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 132 PID 2620 set thread context of 764 2620 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 95 PID 764 set thread context of 2168 764 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 97 PID 2168 set thread context of 2932 2168 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 196 PID 2932 set thread context of 3068 2932 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 101 PID 3068 set thread context of 904 3068 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 309 PID 904 set thread context of 1900 904 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 284 PID 1900 set thread context of 2996 1900 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 355 PID 2996 set thread context of 2132 2996 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 109 PID 2132 set thread context of 1272 2132 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 207 PID 1272 set thread context of 2732 1272 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 113 PID 2732 set thread context of 2556 2732 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 287 PID 2556 set thread context of 3020 2556 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 270 PID 3020 set thread context of 2516 3020 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 184 PID 2516 set thread context of 1120 2516 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 254 PID 1120 set thread context of 1952 1120 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 190 PID 1952 set thread context of 2800 1952 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 193 PID 2800 set thread context of 812 2800 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 127 PID 812 set thread context of 2396 812 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 164 PID 2396 set thread context of 1712 2396 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 131 PID 1712 set thread context of 2052 1712 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 133 PID 2052 set thread context of 1220 2052 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 265 PID 1220 set thread context of 1156 1220 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 137 PID 1156 set thread context of 688 1156 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 224 PID 688 set thread context of 1936 688 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 141 PID 1936 set thread context of 2412 1936 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 143 PID 2412 set thread context of 1052 2412 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 179 PID 1052 set thread context of 744 1052 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 180 PID 744 set thread context of 2536 744 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 149 PID 2536 set thread context of 2564 2536 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 151 PID 2564 set thread context of 2384 2564 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 153 PID 2384 set thread context of 1764 2384 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 257 PID 1764 set thread context of 2244 1764 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 214 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3036 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2128 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2940 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2760 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1656 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2504 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1268 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2708 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2332 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1444 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1696 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2200 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 3068 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1132 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 768 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1740 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2412 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2232 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2284 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 744 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1584 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2748 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2516 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1756 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2376 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2728 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2964 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2508 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 568 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1712 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2620 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 764 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2168 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2932 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 3068 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 904 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1900 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2996 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2132 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1272 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2732 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2556 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 3020 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2516 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1120 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1952 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2800 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 812 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2396 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1712 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2052 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1220 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1156 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 688 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1936 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2412 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1052 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 744 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2536 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2564 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 2384 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe Token: SeDebugPrivilege 1764 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2160 3036 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 30 PID 3036 wrote to memory of 2160 3036 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 30 PID 3036 wrote to memory of 2160 3036 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 30 PID 3036 wrote to memory of 2128 3036 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 31 PID 3036 wrote to memory of 2128 3036 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 31 PID 3036 wrote to memory of 2128 3036 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 31 PID 3036 wrote to memory of 2128 3036 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 31 PID 3036 wrote to memory of 2128 3036 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 31 PID 3036 wrote to memory of 2128 3036 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 31 PID 3036 wrote to memory of 2128 3036 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 31 PID 3036 wrote to memory of 2128 3036 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 31 PID 2128 wrote to memory of 2688 2128 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 32 PID 2128 wrote to memory of 2688 2128 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 32 PID 2128 wrote to memory of 2688 2128 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 32 PID 2128 wrote to memory of 2940 2128 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 33 PID 2128 wrote to memory of 2940 2128 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 33 PID 2128 wrote to memory of 2940 2128 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 33 PID 2128 wrote to memory of 2940 2128 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 33 PID 2128 wrote to memory of 2940 2128 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 33 PID 2128 wrote to memory of 2940 2128 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 33 PID 2128 wrote to memory of 2940 2128 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 33 PID 2128 wrote to memory of 2940 2128 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 33 PID 2940 wrote to memory of 2860 2940 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 34 PID 2940 wrote to memory of 2860 2940 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 34 PID 2940 wrote to memory of 2860 2940 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 34 PID 2940 wrote to memory of 2908 2940 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 35 PID 2940 wrote to memory of 2908 2940 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 35 PID 2940 wrote to memory of 2908 2940 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 35 PID 2940 wrote to memory of 2908 2940 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 35 PID 2940 wrote to memory of 2908 2940 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 35 PID 2940 wrote to memory of 2908 2940 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 35 PID 2940 wrote to memory of 2908 2940 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 35 PID 2940 wrote to memory of 2908 2940 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 35 PID 2908 wrote to memory of 2576 2908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 36 PID 2908 wrote to memory of 2576 2908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 36 PID 2908 wrote to memory of 2576 2908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 36 PID 2908 wrote to memory of 2760 2908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 37 PID 2908 wrote to memory of 2760 2908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 37 PID 2908 wrote to memory of 2760 2908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 37 PID 2908 wrote to memory of 2760 2908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 37 PID 2908 wrote to memory of 2760 2908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 37 PID 2908 wrote to memory of 2760 2908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 37 PID 2908 wrote to memory of 2760 2908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 37 PID 2908 wrote to memory of 2760 2908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 37 PID 2760 wrote to memory of 3060 2760 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 38 PID 2760 wrote to memory of 3060 2760 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 38 PID 2760 wrote to memory of 3060 2760 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 38 PID 2760 wrote to memory of 1908 2760 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 39 PID 2760 wrote to memory of 1908 2760 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 39 PID 2760 wrote to memory of 1908 2760 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 39 PID 2760 wrote to memory of 1908 2760 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 39 PID 2760 wrote to memory of 1908 2760 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 39 PID 2760 wrote to memory of 1908 2760 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 39 PID 2760 wrote to memory of 1908 2760 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 39 PID 2760 wrote to memory of 1908 2760 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 39 PID 1908 wrote to memory of 1744 1908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 40 PID 1908 wrote to memory of 1744 1908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 40 PID 1908 wrote to memory of 1744 1908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 40 PID 1908 wrote to memory of 1656 1908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 41 PID 1908 wrote to memory of 1656 1908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 41 PID 1908 wrote to memory of 1656 1908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 41 PID 1908 wrote to memory of 1656 1908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 41 PID 1908 wrote to memory of 1656 1908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 41 PID 1908 wrote to memory of 1656 1908 ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe2⤵PID:2160
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe3⤵PID:2688
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe4⤵PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe5⤵PID:2576
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe5⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe6⤵PID:3060
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe7⤵PID:1744
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe8⤵PID:860
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe8⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe9⤵PID:2852
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe9⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe10⤵PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe10⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe11⤵PID:2720
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe11⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe12⤵PID:1140
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe12⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe13⤵PID:1528
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe13⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe14⤵PID:2148
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe14⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe15⤵PID:2976
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe15⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe16⤵PID:2112
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe16⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe17⤵PID:2068
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe17⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:768 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe18⤵PID:328
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe18⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe19⤵PID:2664
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe19⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe20⤵PID:1716
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe20⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe21⤵PID:3000
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe21⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe22⤵PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe22⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:744 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe23⤵PID:2152
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe23⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe24⤵PID:2196
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe24⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe25⤵PID:2520
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe25⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe26⤵PID:1956
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe26⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe27⤵PID:1460
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe27⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe28⤵PID:1032
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe28⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe29⤵PID:348
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe29⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe30⤵PID:1340
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe30⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe31⤵PID:1388
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe31⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:568 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe32⤵PID:356
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe32⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe33⤵PID:2024
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe33⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe34⤵PID:2368
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe34⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:764 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe35⤵PID:2356
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe35⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe36⤵PID:2016
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe36⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe37⤵PID:2416
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe37⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe38⤵PID:1132
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe38⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:904 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe39⤵PID:1972
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe39⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe40⤵PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe40⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe41⤵PID:324
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe41⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe42⤵PID:1296
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe42⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe43⤵PID:1992
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe43⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe44⤵PID:2772
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe44⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe45⤵PID:2080
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe45⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe46⤵PID:3016
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe46⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe47⤵PID:1756
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe47⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe48⤵PID:2956
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe48⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe49⤵PID:2500
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe49⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe50⤵PID:2824
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe50⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:812 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe51⤵PID:1240
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe51⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe52⤵PID:2332
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe52⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe53⤵PID:2620
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe53⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe54⤵PID:1616
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe54⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe55⤵PID:1092
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe55⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe56⤵PID:316
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe56⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:688 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe57⤵PID:768
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe57⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe58⤵PID:2484
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe58⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe59⤵PID:1264
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe59⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe60⤵PID:2204
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe60⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:744 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe61⤵PID:3024
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe61⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe62⤵PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe62⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe63⤵PID:1284
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe63⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe64⤵PID:2908
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe64⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe65⤵PID:2960
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe65⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe66⤵PID:2812
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe66⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe67⤵PID:2300
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe67⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe68⤵PID:1280
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe68⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe69⤵PID:2396
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe69⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe70⤵PID:1672
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe70⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe71⤵PID:2208
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe71⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe72⤵PID:352
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe72⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe73⤵PID:2988
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe73⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe74⤵PID:1700
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe74⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe75⤵PID:1932
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe75⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe76⤵PID:2928
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe76⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe77⤵PID:744
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe77⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe78⤵PID:2640
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe78⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe79⤵PID:2516
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe79⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe80⤵PID:2176
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe80⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe81⤵PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe81⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe82⤵PID:1952
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe82⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe83⤵PID:1608
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe83⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe84⤵PID:2164
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe84⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe85⤵PID:2932
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe85⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe86⤵PID:1808
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe86⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe87⤵PID:1632
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe87⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe88⤵PID:2444
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe88⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe89⤵PID:1396
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe89⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe90⤵PID:1660
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe90⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe91⤵PID:2780
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe91⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe92⤵PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe92⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe93⤵PID:960
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe93⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe94⤵PID:2244
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe94⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe95⤵PID:1520
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe95⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe96⤵PID:2708
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe96⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe97⤵PID:2972
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe97⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe98⤵PID:2140
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe98⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe99⤵PID:688
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe99⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe100⤵PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe100⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe101⤵PID:1568
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe101⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe102⤵PID:2432
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe102⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe103⤵PID:2544
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe103⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe104⤵PID:2572
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe104⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe105⤵PID:2792
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe105⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe106⤵PID:632
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe106⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe107⤵PID:1880
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe107⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe108⤵PID:840
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe108⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe109⤵PID:1360
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe109⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe110⤵PID:1844
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe110⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe111⤵PID:2656
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe111⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe112⤵PID:1148
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe112⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe113⤵PID:2868
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe113⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe114⤵PID:1120
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe114⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe115⤵PID:1920
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe115⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe116⤵PID:2304
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe116⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe117⤵PID:588
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe117⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe118⤵PID:1944
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe118⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe119⤵PID:2360
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe119⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe120⤵PID:1788
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe120⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe121⤵PID:2700
-
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe121⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ab36e42286bec0e96c6a7cb11c134c74_JaffaCakes118.exe122⤵PID:3020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-