Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
04/10/2024, 19:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe
Resource
win7-20240903-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe
Resource
win10v2004-20240802-en
2 signatures
150 seconds
General
- Target 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe
- Size 302KB
- Sample241004-ybehdsxalb
- SHA256 f099d27d8b06291a3c8aace4b6f46eff2f229040d14765e34a28386fc33952a6
- MD5 14ac6085a1aeed6524330d5dbed21683
- SHA1 ebb220b057453dc12a569227afa748d38efa11be
- SHA512 a23555303cca0b44cdee1c84ec0ce1d15fbda20d0716a9e6577bb2f032cf078d37ce39d79df066a00bd3ede643bca13b156209f8f82ec4371591dc8e0c281c73
- SSDEEP 6144:5PNMCmiSCi21Bz+RksQUSv3aT0tJ/CiT4LKvgsv5pe5t+R3IIhIIW:5WClNZzxlhv3IiJ6iTnFIIhII
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2636 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 2244 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 1308 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 1440 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 5084 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 636 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 2268 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 4328 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3684 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3584 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 1012 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 216 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 1472 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3952 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 1912 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 212 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 2076 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 4392 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 4988 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 4636 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3184 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3032 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 1772 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 2080 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3040 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 2532 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3984 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 4432 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 1544 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 2004 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 768 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 8 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3416 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 2324 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 2944 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3624 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 4844 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3980 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 4532 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 5028 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3280 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3472 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 1212 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 756 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 4300 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 1300 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3936 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3220 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 1440 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 1144 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 2980 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3956 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 2252 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 4052 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3024 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 952 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 1824 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 4384 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 1396 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 2376 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 1236 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 1548 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 688 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe Token: SeDebugPrivilege 3144 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2244 2636 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 82 PID 2636 wrote to memory of 2244 2636 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 82 PID 2244 wrote to memory of 1308 2244 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 83 PID 2244 wrote to memory of 1308 2244 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 83 PID 1308 wrote to memory of 1440 1308 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 84 PID 1308 wrote to memory of 1440 1308 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 84 PID 1440 wrote to memory of 5084 1440 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 85 PID 1440 wrote to memory of 5084 1440 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 85 PID 5084 wrote to memory of 636 5084 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 86 PID 5084 wrote to memory of 636 5084 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 86 PID 636 wrote to memory of 2268 636 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 87 PID 636 wrote to memory of 2268 636 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 87 PID 2268 wrote to memory of 4328 2268 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 88 PID 2268 wrote to memory of 4328 2268 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 88 PID 4328 wrote to memory of 3684 4328 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 89 PID 4328 wrote to memory of 3684 4328 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 89 PID 3684 wrote to memory of 3584 3684 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 90 PID 3684 wrote to memory of 3584 3684 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 90 PID 3584 wrote to memory of 1012 3584 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 91 PID 3584 wrote to memory of 1012 3584 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 91 PID 1012 wrote to memory of 216 1012 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 92 PID 1012 wrote to memory of 216 1012 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 92 PID 216 wrote to memory of 1472 216 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 93 PID 216 wrote to memory of 1472 216 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 93 PID 1472 wrote to memory of 3952 1472 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 94 PID 1472 wrote to memory of 3952 1472 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 94 PID 3952 wrote to memory of 1912 3952 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 95 PID 3952 wrote to memory of 1912 3952 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 95 PID 1912 wrote to memory of 212 1912 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 96 PID 1912 wrote to memory of 212 1912 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 96 PID 212 wrote to memory of 2076 212 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 97 PID 212 wrote to memory of 2076 212 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 97 PID 2076 wrote to memory of 4392 2076 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 98 PID 2076 wrote to memory of 4392 2076 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 98 PID 4392 wrote to memory of 4988 4392 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 99 PID 4392 wrote to memory of 4988 4392 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 99 PID 4988 wrote to memory of 4636 4988 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 100 PID 4988 wrote to memory of 4636 4988 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 100 PID 4636 wrote to memory of 3184 4636 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 101 PID 4636 wrote to memory of 3184 4636 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 101 PID 3184 wrote to memory of 3032 3184 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 102 PID 3184 wrote to memory of 3032 3184 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 102 PID 3032 wrote to memory of 1772 3032 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 103 PID 3032 wrote to memory of 1772 3032 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 103 PID 1772 wrote to memory of 2080 1772 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 104 PID 1772 wrote to memory of 2080 1772 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 104 PID 2080 wrote to memory of 3040 2080 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 105 PID 2080 wrote to memory of 3040 2080 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 105 PID 3040 wrote to memory of 2532 3040 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 106 PID 3040 wrote to memory of 2532 3040 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 106 PID 2532 wrote to memory of 3984 2532 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 107 PID 2532 wrote to memory of 3984 2532 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 107 PID 3984 wrote to memory of 4432 3984 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 108 PID 3984 wrote to memory of 4432 3984 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 108 PID 4432 wrote to memory of 1544 4432 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 109 PID 4432 wrote to memory of 1544 4432 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 109 PID 1544 wrote to memory of 2004 1544 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 110 PID 1544 wrote to memory of 2004 1544 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 110 PID 2004 wrote to memory of 768 2004 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 111 PID 2004 wrote to memory of 768 2004 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 111 PID 768 wrote to memory of 8 768 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 112 PID 768 wrote to memory of 8 768 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 112 PID 8 wrote to memory of 3416 8 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 113 PID 8 wrote to memory of 3416 8 14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:756 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe46⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:952 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:688 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe65⤵
- Suspicious use of AdjustPrivilegeToken
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe66⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe67⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe68⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe69⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe70⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe71⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe72⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe73⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe74⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe75⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe76⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe77⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe78⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe79⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe80⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe81⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe82⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe83⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe84⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe85⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe86⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe87⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe88⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe89⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe90⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe91⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe92⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe93⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe94⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe95⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe96⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe97⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe98⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe99⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe100⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe101⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe102⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe103⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe104⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe105⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe106⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe107⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe108⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe109⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe110⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe111⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe112⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe113⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe114⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe115⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe116⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe117⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe118⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe119⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe120⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe121⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\14ac6085a1aeed6524330d5dbed21683_JaffaCakes118.exe122⤵PID:4544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-