Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2024, 20:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe
Resource
win7-20240903-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe
Resource
win10v2004-20241007-en
2 signatures
150 seconds
General
-
Target
70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe
-
Size
222KB
-
MD5
70a79cb48022fe9d224a89310047dc13
-
SHA1
5873b6643e76774d861c893af2f656771379fd34
-
SHA256
80eb5a5842f6f4d74f187d80312498a92f60f9746058bee8c4c4168794b3b4d0
-
SHA512
83ac6c7bb9bde00e1d3dc194d6e8397f9ac82d7049409dad82069b2fa8abbf61c44aaa6b76c83d667cd4e22a57ab524a927bf0e138c93053fd7408e0c1ec01fb
-
SSDEEP
3072:n5y+yGlPKsNMu+H1rQT8jFCNQr2yhvzLAupOSnTsoKIZALlZjA6qw:c+XquKrm2WCvzL9OSnmIZQ/jA6F
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4988 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 3940 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 1852 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 180 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4736 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 1600 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4112 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 5112 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 760 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 460 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4776 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 60 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 3684 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4728 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 1044 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4840 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 5080 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 3412 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 3328 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 2448 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 2976 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 724 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4348 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4328 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4160 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 1772 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4324 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 1612 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 3260 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 180 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 1652 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4332 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 3360 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4960 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 2756 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 1816 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 3892 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4384 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 2212 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 2576 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 1320 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 408 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 756 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4972 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4540 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 3984 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 3856 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 3916 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 928 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4328 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4160 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 1844 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 1612 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 1976 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4764 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 2668 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 2040 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 1116 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 648 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 1948 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 2860 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 2512 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 4376 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe Token: SeDebugPrivilege 5084 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4988 wrote to memory of 3940 4988 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 84 PID 4988 wrote to memory of 3940 4988 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 84 PID 3940 wrote to memory of 1852 3940 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 85 PID 3940 wrote to memory of 1852 3940 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 85 PID 1852 wrote to memory of 180 1852 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 86 PID 1852 wrote to memory of 180 1852 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 86 PID 180 wrote to memory of 4736 180 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 87 PID 180 wrote to memory of 4736 180 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 87 PID 4736 wrote to memory of 1600 4736 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 90 PID 4736 wrote to memory of 1600 4736 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 90 PID 1600 wrote to memory of 4112 1600 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 91 PID 1600 wrote to memory of 4112 1600 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 91 PID 4112 wrote to memory of 5112 4112 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 92 PID 4112 wrote to memory of 5112 4112 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 92 PID 5112 wrote to memory of 760 5112 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 94 PID 5112 wrote to memory of 760 5112 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 94 PID 760 wrote to memory of 460 760 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 96 PID 760 wrote to memory of 460 760 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 96 PID 460 wrote to memory of 4776 460 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 99 PID 460 wrote to memory of 4776 460 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 99 PID 4776 wrote to memory of 60 4776 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 101 PID 4776 wrote to memory of 60 4776 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 101 PID 60 wrote to memory of 3684 60 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 102 PID 60 wrote to memory of 3684 60 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 102 PID 3684 wrote to memory of 4728 3684 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 103 PID 3684 wrote to memory of 4728 3684 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 103 PID 4728 wrote to memory of 1044 4728 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 104 PID 4728 wrote to memory of 1044 4728 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 104 PID 1044 wrote to memory of 4840 1044 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 105 PID 1044 wrote to memory of 4840 1044 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 105 PID 4840 wrote to memory of 5080 4840 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 106 PID 4840 wrote to memory of 5080 4840 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 106 PID 5080 wrote to memory of 3412 5080 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 107 PID 5080 wrote to memory of 3412 5080 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 107 PID 3412 wrote to memory of 3328 3412 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 108 PID 3412 wrote to memory of 3328 3412 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 108 PID 3328 wrote to memory of 2448 3328 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 109 PID 3328 wrote to memory of 2448 3328 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 109 PID 2448 wrote to memory of 2976 2448 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 110 PID 2448 wrote to memory of 2976 2448 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 110 PID 2976 wrote to memory of 724 2976 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 111 PID 2976 wrote to memory of 724 2976 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 111 PID 724 wrote to memory of 4348 724 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 112 PID 724 wrote to memory of 4348 724 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 112 PID 4348 wrote to memory of 4328 4348 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 113 PID 4348 wrote to memory of 4328 4348 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 113 PID 4328 wrote to memory of 4160 4328 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 114 PID 4328 wrote to memory of 4160 4328 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 114 PID 4160 wrote to memory of 1772 4160 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 115 PID 4160 wrote to memory of 1772 4160 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 115 PID 1772 wrote to memory of 4324 1772 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 116 PID 1772 wrote to memory of 4324 1772 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 116 PID 4324 wrote to memory of 1612 4324 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 117 PID 4324 wrote to memory of 1612 4324 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 117 PID 1612 wrote to memory of 3260 1612 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 118 PID 1612 wrote to memory of 3260 1612 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 118 PID 3260 wrote to memory of 180 3260 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 119 PID 3260 wrote to memory of 180 3260 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 119 PID 180 wrote to memory of 1652 180 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 120 PID 180 wrote to memory of 1652 180 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 120 PID 1652 wrote to memory of 4332 1652 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 121 PID 1652 wrote to memory of 4332 1652 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 121 PID 4332 wrote to memory of 3360 4332 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 123 PID 4332 wrote to memory of 3360 4332 70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:180 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe29⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe30⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:180 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:408 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:756 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:928 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:648 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe65⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe66⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe67⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe68⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe69⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe70⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe71⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe72⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe73⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe74⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe75⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe76⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe77⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe78⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe79⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe80⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe81⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe82⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe83⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe84⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe85⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe86⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe87⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe88⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe89⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe90⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe91⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe92⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe93⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe94⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe95⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe96⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe97⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe98⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe99⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe100⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe101⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe102⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe103⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe104⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe105⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe106⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe107⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe108⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe109⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe110⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe111⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe112⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe113⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe114⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe115⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe116⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe117⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe118⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe119⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe120⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe121⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\70a79cb48022fe9d224a89310047dc13_JaffaCakes118.exe122⤵PID:3548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-