Analysis
- max time kernel
102s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 21:41
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe
- Size 58KB
- Sample260924-1j2zrssgnc
- SHA256 a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af
- MD5 29eb1f8ea69009d60eb7990738019934
- SHA1 b104014638b86fc4b570f6e3c8595fd403a9b61c
- SHA512 aceab3029e63232444d0795da96d654c8a3768541035b0e757604ccb733051f0879f754e8e8c33c2f6337124b432ad8cff2e28acbbf59068054c91c10edb37a4
- SSDEEP 1536:TByy+3kUQQulWxQeF7GEJEnlJz+8Lhp7fqUO:sybUmJaXJEnbKID
- TLSH T10643D015ABCE4327E6AE17BEC1F227540BF4D336A99BFB0F2EC420C55E5A78540406A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe File opened for modification C:\Windows\assembly\Desktop.ini jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe File created C:\Windows\assembly\Desktop.ini jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe File opened for modification C:\Windows\assembly\Desktop.ini jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4796 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 4796 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 4796 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 240 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 240 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 240 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 4260 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 4260 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 4260 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 4804 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 4804 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 4804 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 956 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 956 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 956 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 3348 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 3348 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 3348 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 4592 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 4592 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 4592 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 5692 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 5692 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 5692 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 4456 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 4456 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 4456 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 2332 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 2332 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 2332 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 264 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 264 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 264 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 2124 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 2124 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 2124 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 4164 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 4164 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 4164 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 4660 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 4660 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 4660 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 4476 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 4476 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 4476 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 4072 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 4072 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 4072 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 4316 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 4316 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 4316 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 5020 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 5020 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 5020 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 2404 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 2404 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 2404 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 5664 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 5664 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 5664 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 2504 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: 33 2504 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeIncBasePriorityPrivilege 2504 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe Token: SeDebugPrivilege 4472 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4796 wrote to memory of 240 4796 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 88 PID 240 wrote to memory of 4260 240 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 89 PID 4260 wrote to memory of 4804 4260 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 90 PID 4804 wrote to memory of 956 4804 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 91 PID 956 wrote to memory of 3348 956 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 92 PID 3348 wrote to memory of 4592 3348 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 93 PID 4592 wrote to memory of 5692 4592 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 94 PID 5692 wrote to memory of 4456 5692 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 95 PID 4456 wrote to memory of 2332 4456 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 96 PID 2332 wrote to memory of 264 2332 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 97 PID 264 wrote to memory of 2124 264 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 98 PID 2124 wrote to memory of 4164 2124 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 99 PID 4164 wrote to memory of 4660 4164 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 100 PID 4660 wrote to memory of 4476 4660 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 101 PID 4476 wrote to memory of 4072 4476 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 102 PID 4072 wrote to memory of 4316 4072 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 103 PID 4316 wrote to memory of 5020 4316 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 104 PID 5020 wrote to memory of 2404 5020 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 105 PID 2404 wrote to memory of 5664 2404 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 106 PID 5664 wrote to memory of 2504 5664 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 107 PID 2504 wrote to memory of 4472 2504 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 108 PID 4472 wrote to memory of 4868 4472 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 109 PID 4868 wrote to memory of 3176 4868 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 110 PID 3176 wrote to memory of 2380 3176 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 111 PID 2380 wrote to memory of 2288 2380 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 112 PID 2288 wrote to memory of 3880 2288 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 113 PID 3880 wrote to memory of 4040 3880 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 114 PID 4040 wrote to memory of 5596 4040 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 115 PID 5596 wrote to memory of 3980 5596 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 116 PID 3980 wrote to memory of 3644 3980 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 117 PID 3644 wrote to memory of 3044 3644 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 118 PID 3044 wrote to memory of 4156 3044 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 119 PID 4156 wrote to memory of 4500 4156 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 120 PID 4500 wrote to memory of 4140 4500 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 121 PID 4140 wrote to memory of 2632 4140 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 122 PID 2632 wrote to memory of 5908 2632 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 123 PID 5908 wrote to memory of 204 5908 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 124 PID 204 wrote to memory of 1436 204 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 125 PID 1436 wrote to memory of 5040 1436 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 126 PID 5040 wrote to memory of 3232 5040 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 127 PID 3232 wrote to memory of 1088 3232 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 128 PID 1088 wrote to memory of 2252 1088 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 129 PID 2252 wrote to memory of 3516 2252 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 130 PID 3516 wrote to memory of 4136 3516 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 131 PID 4136 wrote to memory of 5508 4136 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 132 PID 5508 wrote to memory of 1508 5508 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 133 PID 1508 wrote to memory of 2920 1508 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 134 PID 2920 wrote to memory of 1140 2920 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 135 PID 1140 wrote to memory of 4972 1140 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 136 PID 4972 wrote to memory of 3020 4972 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 137 PID 3020 wrote to memory of 4628 3020 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 138 PID 4628 wrote to memory of 5368 4628 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 139 PID 5368 wrote to memory of 5116 5368 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 140 PID 5116 wrote to memory of 2500 5116 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 141 PID 2500 wrote to memory of 1656 2500 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 142 PID 1656 wrote to memory of 5784 1656 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 143 PID 5784 wrote to memory of 4924 5784 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 144 PID 4924 wrote to memory of 3916 4924 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 145 PID 3916 wrote to memory of 3448 3916 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 146 PID 3448 wrote to memory of 2544 3448 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 147 PID 2544 wrote to memory of 1824 2544 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 148 PID 1824 wrote to memory of 4392 1824 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 149 PID 4392 wrote to memory of 4100 4392 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 150 PID 4100 wrote to memory of 5232 4100 jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe23⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe24⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe25⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe26⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe27⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe28⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe29⤵
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe30⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe31⤵
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe32⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe33⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe34⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe35⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe36⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe37⤵
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe38⤵
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe39⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe40⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe41⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe42⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe43⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe44⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe45⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe46⤵
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe47⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe48⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe49⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe50⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe51⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe52⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe53⤵
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe54⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe55⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe56⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe57⤵
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe58⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe59⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe60⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe61⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe62⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe63⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe64⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe65⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe66⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe67⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe68⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe69⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe70⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe71⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe72⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe73⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe74⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe75⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe76⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe77⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe78⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe79⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe80⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe81⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe82⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe83⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe84⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe85⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe86⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe87⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe88⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe89⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe90⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe91⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe92⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe93⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe94⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe95⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe96⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe97⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe98⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe99⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe100⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe101⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe102⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe103⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe104⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe105⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe106⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe107⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe108⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe109⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe110⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe111⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe112⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe113⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe114⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe115⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe116⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe117⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe118⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe119⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe120⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe121⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8c48c6a82e01afb3e47e097e87bc5f36a5df5131fcbccfe2eba0739b79fa4af.exe122⤵PID:3428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-