Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 09:50
Static task
static1
Behavioral task
behavioral1
Sample
1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe
-
Size
48KB
-
MD5
1798dccb07a1c7b98fc54de7f6ec032b
-
SHA1
81718876c3c2efa9635f0bcfa20fd7250f5d4806
-
SHA256
d7e3ec6bcefac8caf23a2854adad96ad99c24ed45e583e1b21e52283f2aff0aa
-
SHA512
dfab05a12e641955b234bb068ed6c502b3e54e8f567085fd01515ee455000bdaaf431790e617c980fdf72aa8b47b142aea7f4e9da25c11d831b0d24913d1b1a2
-
SSDEEP
768:I6QqT841RFqaKJk/lKqHmLMfiGQ0A0AO6iZMCrjODA/sHSpdhzzSyVc84Keo:I6QyBqy/lWLMfiGQ0Ain/8HMH6o
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3664 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1588 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4868 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4016 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4708 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 708 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1472 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4816 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2864 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 436 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 924 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 872 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4476 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4852 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1196 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2712 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 5056 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4680 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2080 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 3652 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4520 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 3908 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1540 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4168 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 400 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4296 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 3012 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2344 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4660 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 3396 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1176 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2316 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4676 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4556 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 348 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 3044 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4920 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4944 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4396 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 3492 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 3468 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 3984 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 8 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 5076 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4244 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 3928 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1932 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 3420 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4000 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 932 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1164 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1216 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4668 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2060 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 1744 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2796 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 4824 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 3624 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 3192 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 412 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2552 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 2024 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe Token: SeDebugPrivilege 5044 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3664 wrote to memory of 1588 3664 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 82 PID 3664 wrote to memory of 1588 3664 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 82 PID 1588 wrote to memory of 4868 1588 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 83 PID 1588 wrote to memory of 4868 1588 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 83 PID 4868 wrote to memory of 4016 4868 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 84 PID 4868 wrote to memory of 4016 4868 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 84 PID 4016 wrote to memory of 4708 4016 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 85 PID 4016 wrote to memory of 4708 4016 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 85 PID 4708 wrote to memory of 708 4708 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 86 PID 4708 wrote to memory of 708 4708 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 86 PID 708 wrote to memory of 1472 708 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 87 PID 708 wrote to memory of 1472 708 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 87 PID 1472 wrote to memory of 4816 1472 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 88 PID 1472 wrote to memory of 4816 1472 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 88 PID 4816 wrote to memory of 2864 4816 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 89 PID 4816 wrote to memory of 2864 4816 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 89 PID 2864 wrote to memory of 436 2864 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 90 PID 2864 wrote to memory of 436 2864 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 90 PID 436 wrote to memory of 924 436 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 91 PID 436 wrote to memory of 924 436 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 91 PID 924 wrote to memory of 872 924 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 92 PID 924 wrote to memory of 872 924 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 92 PID 872 wrote to memory of 4476 872 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 93 PID 872 wrote to memory of 4476 872 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 93 PID 4476 wrote to memory of 4852 4476 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 94 PID 4476 wrote to memory of 4852 4476 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 94 PID 4852 wrote to memory of 1196 4852 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 95 PID 4852 wrote to memory of 1196 4852 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 95 PID 1196 wrote to memory of 2712 1196 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 96 PID 1196 wrote to memory of 2712 1196 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 96 PID 2712 wrote to memory of 5056 2712 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 97 PID 2712 wrote to memory of 5056 2712 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 97 PID 5056 wrote to memory of 4680 5056 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 98 PID 5056 wrote to memory of 4680 5056 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 98 PID 4680 wrote to memory of 2080 4680 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 99 PID 4680 wrote to memory of 2080 4680 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 99 PID 2080 wrote to memory of 3652 2080 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 100 PID 2080 wrote to memory of 3652 2080 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 100 PID 3652 wrote to memory of 4520 3652 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 101 PID 3652 wrote to memory of 4520 3652 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 101 PID 4520 wrote to memory of 3908 4520 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 102 PID 4520 wrote to memory of 3908 4520 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 102 PID 3908 wrote to memory of 1540 3908 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 103 PID 3908 wrote to memory of 1540 3908 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 103 PID 1540 wrote to memory of 4168 1540 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 104 PID 1540 wrote to memory of 4168 1540 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 104 PID 4168 wrote to memory of 400 4168 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 105 PID 4168 wrote to memory of 400 4168 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 105 PID 400 wrote to memory of 4296 400 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 106 PID 400 wrote to memory of 4296 400 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 106 PID 4296 wrote to memory of 2924 4296 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 107 PID 4296 wrote to memory of 2924 4296 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 107 PID 2924 wrote to memory of 3012 2924 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 108 PID 2924 wrote to memory of 3012 2924 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 108 PID 3012 wrote to memory of 2344 3012 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 109 PID 3012 wrote to memory of 2344 3012 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 109 PID 2344 wrote to memory of 4660 2344 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 110 PID 2344 wrote to memory of 4660 2344 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 110 PID 4660 wrote to memory of 3396 4660 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 111 PID 4660 wrote to memory of 3396 4660 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 111 PID 3396 wrote to memory of 1176 3396 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 112 PID 3396 wrote to memory of 1176 3396 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 112 PID 1176 wrote to memory of 2316 1176 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 113 PID 1176 wrote to memory of 2316 1176 1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:348 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:8 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:932 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:412 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe65⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe66⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe67⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe68⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe69⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe70⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe71⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe72⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe73⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe74⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe75⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe76⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe77⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe78⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe79⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe80⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe81⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe82⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe83⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe84⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe85⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe86⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe87⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe88⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe89⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe90⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe91⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe92⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe93⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe94⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe95⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe96⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe97⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe98⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe99⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe100⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe101⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe102⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe103⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe104⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe105⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe106⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe107⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe108⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe109⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe110⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe111⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe112⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe113⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe114⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe115⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe116⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe117⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe118⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe119⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe120⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe121⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1798dccb07a1c7b98fc54de7f6ec032b_JaffaCakes118.exe122⤵PID:2292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-