Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 09:50
Static task
static1
Behavioral task
behavioral1
Sample
1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe
-
Size
48KB
-
MD5
1798dccb07a1c7b98fc54de7f6ec032b
-
SHA1
81718876c3c2efa9635f0bcfa20fd7250f5d4806
-
SHA256
d7e3ec6bcefac8caf23a2854adad96ad99c24ed45e583e1b21e52283f2aff0aa
-
SHA512
dfab05a12e641955b234bb068ed6c502b3e54e8f567085fd01515ee455000bdaaf431790e617c980fdf72aa8b47b142aea7f4e9da25c11d831b0d24913d1b1a2
-
SSDEEP
768:I6QqT841RFqaKJk/lKqHmLMfiGQ0A0AO6iZMCrjODA/sHSpdhzzSyVc84Keo:I6QyBqy/lWLMfiGQ0Ain/8HMH6o
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2232 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2184 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2916 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2076 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2840 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 3004 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 3048 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2860 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2848 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2752 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2676 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2740 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2516 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2932 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2256 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1604 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2272 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1244 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2412 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2380 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1748 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1716 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1364 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1852 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1204 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2576 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2824 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 680 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2928 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 992 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2988 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1660 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2288 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 3016 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 788 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 852 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1672 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1888 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 344 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2332 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2132 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2352 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2172 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2448 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 288 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1980 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2708 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2372 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2640 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2684 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2800 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1792 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2536 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2120 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1892 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1416 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1208 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2396 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1264 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2004 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2404 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 816 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1960 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2760 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2184 2232 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 31 PID 2232 wrote to memory of 2184 2232 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 31 PID 2232 wrote to memory of 2184 2232 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 31 PID 2184 wrote to memory of 2916 2184 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 32 PID 2184 wrote to memory of 2916 2184 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 32 PID 2184 wrote to memory of 2916 2184 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 32 PID 2916 wrote to memory of 2076 2916 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 33 PID 2916 wrote to memory of 2076 2916 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 33 PID 2916 wrote to memory of 2076 2916 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 33 PID 2076 wrote to memory of 2840 2076 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 34 PID 2076 wrote to memory of 2840 2076 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 34 PID 2076 wrote to memory of 2840 2076 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 34 PID 2840 wrote to memory of 3004 2840 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 35 PID 2840 wrote to memory of 3004 2840 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 35 PID 2840 wrote to memory of 3004 2840 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 35 PID 3004 wrote to memory of 3048 3004 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 36 PID 3004 wrote to memory of 3048 3004 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 36 PID 3004 wrote to memory of 3048 3004 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 36 PID 3048 wrote to memory of 2860 3048 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 37 PID 3048 wrote to memory of 2860 3048 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 37 PID 3048 wrote to memory of 2860 3048 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 37 PID 2860 wrote to memory of 2848 2860 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 38 PID 2860 wrote to memory of 2848 2860 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 38 PID 2860 wrote to memory of 2848 2860 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 38 PID 2848 wrote to memory of 2752 2848 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 39 PID 2848 wrote to memory of 2752 2848 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 39 PID 2848 wrote to memory of 2752 2848 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 39 PID 2752 wrote to memory of 2676 2752 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 40 PID 2752 wrote to memory of 2676 2752 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 40 PID 2752 wrote to memory of 2676 2752 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 40 PID 2676 wrote to memory of 2740 2676 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 41 PID 2676 wrote to memory of 2740 2676 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 41 PID 2676 wrote to memory of 2740 2676 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 41 PID 2740 wrote to memory of 2516 2740 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 42 PID 2740 wrote to memory of 2516 2740 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 42 PID 2740 wrote to memory of 2516 2740 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 42 PID 2516 wrote to memory of 2932 2516 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 43 PID 2516 wrote to memory of 2932 2516 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 43 PID 2516 wrote to memory of 2932 2516 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 43 PID 2932 wrote to memory of 2256 2932 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 44 PID 2932 wrote to memory of 2256 2932 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 44 PID 2932 wrote to memory of 2256 2932 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 44 PID 2256 wrote to memory of 1604 2256 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 45 PID 2256 wrote to memory of 1604 2256 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 45 PID 2256 wrote to memory of 1604 2256 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 45 PID 1604 wrote to memory of 2272 1604 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 46 PID 1604 wrote to memory of 2272 1604 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 46 PID 1604 wrote to memory of 2272 1604 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 46 PID 2272 wrote to memory of 1244 2272 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 47 PID 2272 wrote to memory of 1244 2272 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 47 PID 2272 wrote to memory of 1244 2272 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 47 PID 1244 wrote to memory of 2412 1244 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 48 PID 1244 wrote to memory of 2412 1244 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 48 PID 1244 wrote to memory of 2412 1244 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 48 PID 2412 wrote to memory of 2380 2412 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 49 PID 2412 wrote to memory of 2380 2412 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 49 PID 2412 wrote to memory of 2380 2412 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 49 PID 2380 wrote to memory of 1748 2380 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 50 PID 2380 wrote to memory of 1748 2380 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 50 PID 2380 wrote to memory of 1748 2380 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 50 PID 1748 wrote to memory of 1716 1748 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 51 PID 1748 wrote to memory of 1716 1748 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 51 PID 1748 wrote to memory of 1716 1748 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 51 PID 1716 wrote to memory of 1364 1716 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
PID:680 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
PID:992 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:788 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:852 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:344 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:288 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:816 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe65⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe66⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe67⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe68⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe69⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe70⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe71⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe72⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe73⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe74⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe75⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe76⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe77⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe78⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe79⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe80⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe81⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe82⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe83⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe84⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe85⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe86⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe87⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe88⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe89⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe90⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe91⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe92⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe93⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe94⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe95⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe96⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe97⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe98⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe99⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe100⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe101⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe102⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe103⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe104⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe105⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe106⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe107⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe108⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe109⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe110⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe111⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe112⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe113⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe114⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe115⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe116⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe117⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe118⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe119⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe120⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe121⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe122⤵PID:1508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-