Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 18:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe
Resource
win7-20240903-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe
Resource
win10v2004-20240802-en
2 signatures
150 seconds
General
-
Target
f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe
-
Size
579KB
-
MD5
f699195cf67b17e78a40c7b18960fa80
-
SHA1
413250885c05d21b8f1ba90f2ddf553944e75c44
-
SHA256
a67384c0d1eae34cd8b42c451b2b3cefc1e3351f00f1915e102f333a4f21b4a8
-
SHA512
c95297273260e8a09cbd03c470cdf7e79838d1c7cb4f73ce908442dd8774f2a5d20228407a151427c70c968edcb4162ab17aa6f559931e70a005d8eeec40646e
-
SSDEEP
12288:/meYO22Sp6Ujhzu9vmfAmoAbTylhdHl5+CC:jtjHUMjrMylz
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2804 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2708 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2852 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2224 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2692 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2556 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2628 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 3000 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 844 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1544 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2784 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2972 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2356 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1176 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2032 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1760 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 340 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2756 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 780 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2948 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2828 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2208 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2312 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1416 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1132 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2240 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2512 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1600 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 788 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2952 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1360 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1708 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2080 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1796 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2968 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2148 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2464 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 688 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1560 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2816 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2920 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2564 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2324 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2728 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2620 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2996 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2600 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 984 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1536 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2896 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1152 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 288 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1736 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1820 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2616 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 532 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 340 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1088 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2408 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2940 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2932 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 3060 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2208 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 440 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2708 2804 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 31 PID 2804 wrote to memory of 2708 2804 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 31 PID 2804 wrote to memory of 2708 2804 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 31 PID 2708 wrote to memory of 2852 2708 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 32 PID 2708 wrote to memory of 2852 2708 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 32 PID 2708 wrote to memory of 2852 2708 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 32 PID 2852 wrote to memory of 2224 2852 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 33 PID 2852 wrote to memory of 2224 2852 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 33 PID 2852 wrote to memory of 2224 2852 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 33 PID 2224 wrote to memory of 2692 2224 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 34 PID 2224 wrote to memory of 2692 2224 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 34 PID 2224 wrote to memory of 2692 2224 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 34 PID 2692 wrote to memory of 2556 2692 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 35 PID 2692 wrote to memory of 2556 2692 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 35 PID 2692 wrote to memory of 2556 2692 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 35 PID 2556 wrote to memory of 2628 2556 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 36 PID 2556 wrote to memory of 2628 2556 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 36 PID 2556 wrote to memory of 2628 2556 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 36 PID 2628 wrote to memory of 3000 2628 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 37 PID 2628 wrote to memory of 3000 2628 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 37 PID 2628 wrote to memory of 3000 2628 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 37 PID 3000 wrote to memory of 844 3000 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 38 PID 3000 wrote to memory of 844 3000 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 38 PID 3000 wrote to memory of 844 3000 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 38 PID 844 wrote to memory of 1544 844 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 39 PID 844 wrote to memory of 1544 844 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 39 PID 844 wrote to memory of 1544 844 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 39 PID 1544 wrote to memory of 2784 1544 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 40 PID 1544 wrote to memory of 2784 1544 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 40 PID 1544 wrote to memory of 2784 1544 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 40 PID 2784 wrote to memory of 2972 2784 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 41 PID 2784 wrote to memory of 2972 2784 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 41 PID 2784 wrote to memory of 2972 2784 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 41 PID 2972 wrote to memory of 2356 2972 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 42 PID 2972 wrote to memory of 2356 2972 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 42 PID 2972 wrote to memory of 2356 2972 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 42 PID 2356 wrote to memory of 1176 2356 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 43 PID 2356 wrote to memory of 1176 2356 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 43 PID 2356 wrote to memory of 1176 2356 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 43 PID 1176 wrote to memory of 2032 1176 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 44 PID 1176 wrote to memory of 2032 1176 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 44 PID 1176 wrote to memory of 2032 1176 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 44 PID 2032 wrote to memory of 1760 2032 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 45 PID 2032 wrote to memory of 1760 2032 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 45 PID 2032 wrote to memory of 1760 2032 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 45 PID 1760 wrote to memory of 340 1760 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 46 PID 1760 wrote to memory of 340 1760 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 46 PID 1760 wrote to memory of 340 1760 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 46 PID 340 wrote to memory of 2756 340 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 47 PID 340 wrote to memory of 2756 340 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 47 PID 340 wrote to memory of 2756 340 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 47 PID 2756 wrote to memory of 780 2756 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 48 PID 2756 wrote to memory of 780 2756 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 48 PID 2756 wrote to memory of 780 2756 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 48 PID 780 wrote to memory of 2948 780 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 49 PID 780 wrote to memory of 2948 780 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 49 PID 780 wrote to memory of 2948 780 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 49 PID 2948 wrote to memory of 2828 2948 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 50 PID 2948 wrote to memory of 2828 2948 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 50 PID 2948 wrote to memory of 2828 2948 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 50 PID 2828 wrote to memory of 2208 2828 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 51 PID 2828 wrote to memory of 2208 2828 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 51 PID 2828 wrote to memory of 2208 2828 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 51 PID 2208 wrote to memory of 2312 2208 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
PID:788 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:688 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:984 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:288 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:532 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:340 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:440 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe65⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe66⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe67⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe68⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe69⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe70⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe71⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe72⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe73⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe74⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe75⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe76⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe77⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe78⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe79⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe80⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe81⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe82⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe83⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe84⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe85⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe86⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe87⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe88⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe89⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe90⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe91⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe92⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe93⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe94⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe95⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe96⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe97⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe98⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe99⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe100⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe101⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe102⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe103⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe104⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe105⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe106⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe107⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe108⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe109⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe110⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe111⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe112⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe113⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe114⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe115⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe116⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe117⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe118⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe119⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe120⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe121⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe122⤵PID:2612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-