Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 23:53
Static task
static1
Behavioral task
behavioral1
Sample
155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe
-
Size
291KB
-
MD5
155fc52a9c214f3eae2a4f00c5ee910c
-
SHA1
3bd46bb0e0c71fbb6e54776f78c3703acdda9b4a
-
SHA256
a2a613f308a64cbeb81a24fbe4544abf83f96cf3ec98ce2e707c62aaa85c46ce
-
SHA512
fb413b64efe1f67b0bf3f4c6a2eb0fe8f0f959f31d05636eabbe57730be7421fd7b247a013f3f392ce38dcd7985aa3d0c701d631b88c24d724cfd44e2fee843e
-
SSDEEP
6144:wPgr6SVzof5e3TbY2T2ykP40MonmzFNki2XPiNkiBPKdrRqf92REXggt:wPgr6SAe3/YyhkwcmzF+iIP8CRqFNVt
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2596 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4600 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 804 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2344 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1624 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4884 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2816 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2104 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 3488 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 3856 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 3740 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1748 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4624 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4888 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1696 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4392 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 3628 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2252 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 976 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2604 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 3228 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1928 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1956 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1104 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1700 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 5044 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2672 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4912 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 3348 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 364 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2240 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2520 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2988 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 3584 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4008 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4968 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1200 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 3272 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4672 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4348 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2720 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4600 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 676 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2296 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1624 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2816 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2104 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 3488 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 3080 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4796 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 452 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2216 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4624 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4888 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2700 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4392 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 3120 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 3112 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4788 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 2636 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4048 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4608 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 1372 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe Token: SeDebugPrivilege 4792 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 4600 2596 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 82 PID 2596 wrote to memory of 4600 2596 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 82 PID 4600 wrote to memory of 804 4600 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 83 PID 4600 wrote to memory of 804 4600 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 83 PID 804 wrote to memory of 2344 804 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 84 PID 804 wrote to memory of 2344 804 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 84 PID 2344 wrote to memory of 1624 2344 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 85 PID 2344 wrote to memory of 1624 2344 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 85 PID 1624 wrote to memory of 4884 1624 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 86 PID 1624 wrote to memory of 4884 1624 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 86 PID 4884 wrote to memory of 2816 4884 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 87 PID 4884 wrote to memory of 2816 4884 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 87 PID 2816 wrote to memory of 2104 2816 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 88 PID 2816 wrote to memory of 2104 2816 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 88 PID 2104 wrote to memory of 3488 2104 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 89 PID 2104 wrote to memory of 3488 2104 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 89 PID 3488 wrote to memory of 3856 3488 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 90 PID 3488 wrote to memory of 3856 3488 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 90 PID 3856 wrote to memory of 3740 3856 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 91 PID 3856 wrote to memory of 3740 3856 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 91 PID 3740 wrote to memory of 1748 3740 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 92 PID 3740 wrote to memory of 1748 3740 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 92 PID 1748 wrote to memory of 4624 1748 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 93 PID 1748 wrote to memory of 4624 1748 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 93 PID 4624 wrote to memory of 4888 4624 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 94 PID 4624 wrote to memory of 4888 4624 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 94 PID 4888 wrote to memory of 1696 4888 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 95 PID 4888 wrote to memory of 1696 4888 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 95 PID 1696 wrote to memory of 4392 1696 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 96 PID 1696 wrote to memory of 4392 1696 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 96 PID 4392 wrote to memory of 3628 4392 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 97 PID 4392 wrote to memory of 3628 4392 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 97 PID 3628 wrote to memory of 2252 3628 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 98 PID 3628 wrote to memory of 2252 3628 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 98 PID 2252 wrote to memory of 976 2252 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 99 PID 2252 wrote to memory of 976 2252 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 99 PID 976 wrote to memory of 2604 976 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 100 PID 976 wrote to memory of 2604 976 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 100 PID 2604 wrote to memory of 3228 2604 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 101 PID 2604 wrote to memory of 3228 2604 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 101 PID 3228 wrote to memory of 1928 3228 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 102 PID 3228 wrote to memory of 1928 3228 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 102 PID 1928 wrote to memory of 1956 1928 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 103 PID 1928 wrote to memory of 1956 1928 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 103 PID 1956 wrote to memory of 1104 1956 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 104 PID 1956 wrote to memory of 1104 1956 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 104 PID 1104 wrote to memory of 1700 1104 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 105 PID 1104 wrote to memory of 1700 1104 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 105 PID 1700 wrote to memory of 5044 1700 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 106 PID 1700 wrote to memory of 5044 1700 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 106 PID 5044 wrote to memory of 2672 5044 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 107 PID 5044 wrote to memory of 2672 5044 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 107 PID 2672 wrote to memory of 4912 2672 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 108 PID 2672 wrote to memory of 4912 2672 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 108 PID 4912 wrote to memory of 3348 4912 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 109 PID 4912 wrote to memory of 3348 4912 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 109 PID 3348 wrote to memory of 364 3348 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 110 PID 3348 wrote to memory of 364 3348 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 110 PID 364 wrote to memory of 2240 364 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 111 PID 364 wrote to memory of 2240 364 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 111 PID 2240 wrote to memory of 2520 2240 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 112 PID 2240 wrote to memory of 2520 2240 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 112 PID 2520 wrote to memory of 2988 2520 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 113 PID 2520 wrote to memory of 2988 2520 155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:676 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:452 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe65⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe66⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe67⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe68⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe69⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe70⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe71⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe72⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe73⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe74⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe75⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe76⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe77⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe78⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe79⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe80⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe81⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe82⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe83⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe84⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe85⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe86⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe87⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe88⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe89⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe90⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe91⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe92⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe93⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe94⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe95⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe96⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe97⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe98⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe99⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe100⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe101⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe102⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe103⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe104⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe105⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe106⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe107⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe108⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe109⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe110⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe111⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe112⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe113⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe114⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe115⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe116⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe117⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe118⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe119⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe120⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe121⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\155fc52a9c214f3eae2a4f00c5ee910c_JaffaCakes118.exe122⤵PID:3068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-