Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 18:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe
Resource
win7-20240903-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe
Resource
win10v2004-20240802-en
2 signatures
150 seconds
General
-
Target
f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe
-
Size
579KB
-
MD5
f699195cf67b17e78a40c7b18960fa80
-
SHA1
413250885c05d21b8f1ba90f2ddf553944e75c44
-
SHA256
a67384c0d1eae34cd8b42c451b2b3cefc1e3351f00f1915e102f333a4f21b4a8
-
SHA512
c95297273260e8a09cbd03c470cdf7e79838d1c7cb4f73ce908442dd8774f2a5d20228407a151427c70c968edcb4162ab17aa6f559931e70a005d8eeec40646e
-
SSDEEP
12288:/meYO22Sp6Ujhzu9vmfAmoAbTylhdHl5+CC:jtjHUMjrMylz
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 688 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 3652 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 3900 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2800 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 968 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 3924 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 3024 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4288 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1900 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2616 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 680 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2908 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1596 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4612 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2976 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 3456 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4160 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4092 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1460 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1432 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2392 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 3896 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4108 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 3572 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2544 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4172 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 3932 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 876 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 5116 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4980 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1988 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2024 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2716 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2840 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4968 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4208 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 3300 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 5004 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2028 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2852 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4948 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4848 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2636 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4984 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4320 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4148 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4752 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 436 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 5060 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 404 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4808 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2688 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1648 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1008 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 1980 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2104 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2940 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 4996 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 704 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 112 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 2964 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 3580 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 468 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe Token: SeDebugPrivilege 400 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 688 wrote to memory of 3652 688 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 82 PID 688 wrote to memory of 3652 688 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 82 PID 3652 wrote to memory of 3900 3652 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 83 PID 3652 wrote to memory of 3900 3652 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 83 PID 3900 wrote to memory of 2800 3900 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 84 PID 3900 wrote to memory of 2800 3900 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 84 PID 2800 wrote to memory of 968 2800 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 85 PID 2800 wrote to memory of 968 2800 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 85 PID 968 wrote to memory of 3924 968 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 86 PID 968 wrote to memory of 3924 968 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 86 PID 3924 wrote to memory of 3024 3924 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 87 PID 3924 wrote to memory of 3024 3924 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 87 PID 3024 wrote to memory of 4288 3024 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 88 PID 3024 wrote to memory of 4288 3024 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 88 PID 4288 wrote to memory of 1900 4288 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 89 PID 4288 wrote to memory of 1900 4288 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 89 PID 1900 wrote to memory of 2616 1900 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 90 PID 1900 wrote to memory of 2616 1900 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 90 PID 2616 wrote to memory of 680 2616 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 91 PID 2616 wrote to memory of 680 2616 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 91 PID 680 wrote to memory of 2908 680 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 92 PID 680 wrote to memory of 2908 680 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 92 PID 2908 wrote to memory of 1596 2908 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 93 PID 2908 wrote to memory of 1596 2908 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 93 PID 1596 wrote to memory of 4612 1596 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 94 PID 1596 wrote to memory of 4612 1596 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 94 PID 4612 wrote to memory of 2976 4612 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 95 PID 4612 wrote to memory of 2976 4612 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 95 PID 2976 wrote to memory of 3456 2976 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 96 PID 2976 wrote to memory of 3456 2976 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 96 PID 3456 wrote to memory of 4160 3456 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 97 PID 3456 wrote to memory of 4160 3456 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 97 PID 4160 wrote to memory of 4092 4160 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 98 PID 4160 wrote to memory of 4092 4160 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 98 PID 4092 wrote to memory of 1460 4092 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 99 PID 4092 wrote to memory of 1460 4092 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 99 PID 1460 wrote to memory of 1432 1460 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 100 PID 1460 wrote to memory of 1432 1460 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 100 PID 1432 wrote to memory of 2392 1432 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 101 PID 1432 wrote to memory of 2392 1432 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 101 PID 2392 wrote to memory of 3896 2392 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 102 PID 2392 wrote to memory of 3896 2392 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 102 PID 3896 wrote to memory of 4108 3896 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 103 PID 3896 wrote to memory of 4108 3896 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 103 PID 4108 wrote to memory of 3572 4108 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 104 PID 4108 wrote to memory of 3572 4108 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 104 PID 3572 wrote to memory of 2544 3572 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 105 PID 3572 wrote to memory of 2544 3572 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 105 PID 2544 wrote to memory of 4172 2544 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 106 PID 2544 wrote to memory of 4172 2544 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 106 PID 4172 wrote to memory of 3932 4172 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 107 PID 4172 wrote to memory of 3932 4172 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 107 PID 3932 wrote to memory of 876 3932 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 108 PID 3932 wrote to memory of 876 3932 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 108 PID 876 wrote to memory of 5116 876 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 109 PID 876 wrote to memory of 5116 876 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 109 PID 5116 wrote to memory of 4980 5116 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 110 PID 5116 wrote to memory of 4980 5116 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 110 PID 4980 wrote to memory of 1988 4980 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 111 PID 4980 wrote to memory of 1988 4980 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 111 PID 1988 wrote to memory of 2024 1988 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 112 PID 1988 wrote to memory of 2024 1988 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 112 PID 2024 wrote to memory of 2716 2024 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 113 PID 2024 wrote to memory of 2716 2024 f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:436 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:404 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:704 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:112 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:468 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:400 -
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe65⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe66⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe67⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe68⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe69⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe70⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe71⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe72⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe73⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe74⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe75⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe76⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe77⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe78⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe79⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe80⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe81⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe82⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe83⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe84⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe85⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe86⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe87⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe88⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe89⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe90⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe91⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe92⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe93⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe94⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe95⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe96⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe97⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe98⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe99⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe100⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe101⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe102⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe103⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe104⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe105⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe106⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe107⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe108⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe109⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe110⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe111⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe112⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe113⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe114⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe115⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe116⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe117⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe118⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe119⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe120⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe121⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f699195cf67b17e78a40c7b18960fa80_JaffaCakes118.exe122⤵PID:1140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-