Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 23:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe
Resource
win7-20240903-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
2 signatures
150 seconds
General
-
Target
155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe
-
Size
291KB
-
MD5
155fc52a9c214f3eae2a4f00c5ee910c
-
SHA1
3bd46bb0e0c71fbb6e54776f78c3703acdda9b4a
-
SHA256
a2a613f308a64cbeb81a24fbe4544abf83f96cf3ec98ce2e707c62aaa85c46ce
-
SHA512
fb413b64efe1f67b0bf3f4c6a2eb0fe8f0f959f31d05636eabbe57730be7421fd7b247a013f3f392ce38dcd7985aa3d0c701d631b88c24d724cfd44e2fee843e
-
SSDEEP
6144:wPgr6SVzof5e3TbY2T2ykP40MonmzFNki2XPiNkiBPKdrRqf92REXggt:wPgr6SAe3/YyhkwcmzF+iIP8CRqFNVt
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2724 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2712 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2892 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2096 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2692 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2976 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2604 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2556 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2960 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2612 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1508 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1924 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2908 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2188 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1744 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 608 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1060 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2204 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1968 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2344 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 708 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2052 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2312 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2576 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2328 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2256 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1724 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 968 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1136 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2684 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 816 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1776 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1572 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1048 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2324 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1328 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1720 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2368 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1732 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2220 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2596 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 3016 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2708 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2180 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2628 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2540 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2492 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2508 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2544 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2968 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2112 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 428 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1916 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2904 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2828 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1032 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1424 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1892 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1344 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1452 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1928 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1972 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2448 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1716 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2724 wrote to memory of 2712 2724 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 30 PID 2724 wrote to memory of 2712 2724 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 30 PID 2724 wrote to memory of 2712 2724 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 30 PID 2712 wrote to memory of 2892 2712 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 31 PID 2712 wrote to memory of 2892 2712 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 31 PID 2712 wrote to memory of 2892 2712 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 31 PID 2892 wrote to memory of 2096 2892 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 32 PID 2892 wrote to memory of 2096 2892 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 32 PID 2892 wrote to memory of 2096 2892 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 32 PID 2096 wrote to memory of 2692 2096 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 33 PID 2096 wrote to memory of 2692 2096 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 33 PID 2096 wrote to memory of 2692 2096 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 33 PID 2692 wrote to memory of 2976 2692 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 34 PID 2692 wrote to memory of 2976 2692 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 34 PID 2692 wrote to memory of 2976 2692 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 34 PID 2976 wrote to memory of 2604 2976 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 35 PID 2976 wrote to memory of 2604 2976 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 35 PID 2976 wrote to memory of 2604 2976 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 35 PID 2604 wrote to memory of 2556 2604 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 36 PID 2604 wrote to memory of 2556 2604 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 36 PID 2604 wrote to memory of 2556 2604 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 36 PID 2556 wrote to memory of 2960 2556 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 37 PID 2556 wrote to memory of 2960 2556 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 37 PID 2556 wrote to memory of 2960 2556 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 37 PID 2960 wrote to memory of 2612 2960 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 38 PID 2960 wrote to memory of 2612 2960 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 38 PID 2960 wrote to memory of 2612 2960 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 38 PID 2612 wrote to memory of 1508 2612 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 39 PID 2612 wrote to memory of 1508 2612 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 39 PID 2612 wrote to memory of 1508 2612 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 39 PID 1508 wrote to memory of 1924 1508 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 40 PID 1508 wrote to memory of 1924 1508 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 40 PID 1508 wrote to memory of 1924 1508 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 40 PID 1924 wrote to memory of 2908 1924 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 41 PID 1924 wrote to memory of 2908 1924 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 41 PID 1924 wrote to memory of 2908 1924 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 41 PID 2908 wrote to memory of 2188 2908 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 42 PID 2908 wrote to memory of 2188 2908 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 42 PID 2908 wrote to memory of 2188 2908 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 42 PID 2188 wrote to memory of 1744 2188 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 43 PID 2188 wrote to memory of 1744 2188 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 43 PID 2188 wrote to memory of 1744 2188 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 43 PID 1744 wrote to memory of 608 1744 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 44 PID 1744 wrote to memory of 608 1744 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 44 PID 1744 wrote to memory of 608 1744 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 44 PID 608 wrote to memory of 1060 608 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 45 PID 608 wrote to memory of 1060 608 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 45 PID 608 wrote to memory of 1060 608 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 45 PID 1060 wrote to memory of 2204 1060 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 46 PID 1060 wrote to memory of 2204 1060 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 46 PID 1060 wrote to memory of 2204 1060 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 46 PID 2204 wrote to memory of 1968 2204 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 47 PID 2204 wrote to memory of 1968 2204 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 47 PID 2204 wrote to memory of 1968 2204 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 47 PID 1968 wrote to memory of 2344 1968 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 48 PID 1968 wrote to memory of 2344 1968 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 48 PID 1968 wrote to memory of 2344 1968 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 48 PID 2344 wrote to memory of 708 2344 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 49 PID 2344 wrote to memory of 708 2344 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 49 PID 2344 wrote to memory of 708 2344 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 49 PID 708 wrote to memory of 2052 708 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 50 PID 708 wrote to memory of 2052 708 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 50 PID 708 wrote to memory of 2052 708 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 50 PID 2052 wrote to memory of 2312 2052 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 51
Processes
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
PID:968 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
PID:816 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:428 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe65⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe66⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe67⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe68⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe69⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe70⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe71⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe72⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe73⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe74⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe75⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe76⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe77⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe78⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe79⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe80⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe81⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe82⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe83⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe84⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe85⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe86⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe87⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe88⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe89⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe90⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe91⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe92⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe93⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe94⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe95⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe96⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe97⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe98⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe99⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe100⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe101⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe102⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe103⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe104⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe105⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe106⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe107⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe108⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe109⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe110⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe111⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe112⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe113⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe114⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe115⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe116⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe117⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe118⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe119⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe120⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe121⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe122⤵PID:736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-