xtremerat | 1d58a1cdcc72b3a9d51176184c052778354e85730b949a872d9c313dcd3b03bb

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 11:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Size 56KB
Sample240626-nh5ytasdpe
SHA256 1d58a1cdcc72b3a9d51176184c052778354e85730b949a872d9c313dcd3b03bb
MD5 11d49abeff7a0511210c37c901b1cff3
SHA1 56a62b7fd615e96560dfc9a9b48a2b59b1eb1f43
SHA512 c961b613c44e2b6fb3942bdff5ffd8cc2b6369771aaa5595ff531800a41219a723294c3f100f0603753ea5bc39eb3bb83a5de8c0eca32ab5115bffd85c1b3bf7
SSDEEP 1536:na1TTJoJppDEE3Vy7hFSVuYE0XdYF36Vwzzjtwtwwc4p:a1vJoJz21wVoidYt6Vw7twKzi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 11 IoCs

resource	yara_rule
behavioral2/memory/2300-8-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2300-9-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2300-12-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/372-20-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/372-21-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/372-25-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2476-32-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1236-51-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1652-75-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3060-128-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1084-136-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Checks computer location settings 2 TTPs 30 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2300-3-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2300-5-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2300-8-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2300-9-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2300-12-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/372-17-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/372-20-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/372-21-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/372-25-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2476-32-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2476-29-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/1236-51-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/1236-50-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/1652-73-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/1652-75-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/3060-126-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/3060-128-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/1084-135-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/1084-136-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx

Suspicious use of SetThreadContext 31 IoCs

description	pid	Process	procid_target
PID 4368 set thread context of 2300	4368	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	83
PID 956 set thread context of 372	956	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	100
PID 2076 set thread context of 2476	2076	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	113
PID 1260 set thread context of 4200	1260	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	123
PID 2456 set thread context of 1236	2456	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	133
PID 3604 set thread context of 4380	3604	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	143
PID 4436 set thread context of 1652	4436	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	153
PID 3080 set thread context of 1924	3080	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	166
PID 3540 set thread context of 3728	3540	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	176
PID 4120 set thread context of 4148	4120	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	186
PID 3428 set thread context of 380	3428	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	196
PID 3032 set thread context of 3060	3032	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	206
PID 4968 set thread context of 1084	4968	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	216
PID 4688 set thread context of 4140	4688	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	226
PID 3640 set thread context of 1100	3640	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	238
PID 3644 set thread context of 1544	3644	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	248
PID 440 set thread context of 4852	440	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	258
PID 4788 set thread context of 2784	4788	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	268
PID 1800 set thread context of 2036	1800	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	278
PID 2724 set thread context of 4660	2724	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	288
PID 2320 set thread context of 716	2320	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	298
PID 1740 set thread context of 380	1740	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	315
PID 2864 set thread context of 4544	2864	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	325
PID 4532 set thread context of 2084	4532	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	335
PID 4640 set thread context of 2956	4640	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	345
PID 5172 set thread context of 5200	5172	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	355
PID 5364 set thread context of 5388	5364	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	365
PID 5548 set thread context of 5576	5548	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	375
PID 5936 set thread context of 5964	5936	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	388
PID 6116 set thread context of 6140	6116	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	398
PID 5316 set thread context of 5204	5316	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	408

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
4368	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
956	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
2076	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
1260	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
2456	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
3604	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
4436	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
3080	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
3540	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
4120	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
3428	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
3032	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
4968	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
4688	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
3640	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
3644	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
440	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
4788	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
1800	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
2724	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
2320	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
1740	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
2864	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
4532	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
4640	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
5172	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
5364	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
5548	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
5936	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
6116	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
5316	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2300	4368	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	83
PID 4368 wrote to memory of 2300	4368	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	83
PID 4368 wrote to memory of 2300	4368	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	83
PID 4368 wrote to memory of 2300	4368	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	83
PID 4368 wrote to memory of 2300	4368	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	83
PID 4368 wrote to memory of 2300	4368	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	83
PID 4368 wrote to memory of 2300	4368	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	83
PID 4368 wrote to memory of 2300	4368	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	83
PID 2300 wrote to memory of 5004	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	84
PID 2300 wrote to memory of 5004	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	84
PID 2300 wrote to memory of 5004	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	84
PID 2300 wrote to memory of 2220	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	88
PID 2300 wrote to memory of 2220	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	88
PID 2300 wrote to memory of 2220	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	88
PID 2300 wrote to memory of 644	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	89
PID 2300 wrote to memory of 644	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	89
PID 2300 wrote to memory of 644	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	89
PID 2300 wrote to memory of 4132	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	90
PID 2300 wrote to memory of 4132	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	90
PID 2300 wrote to memory of 4132	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	90
PID 2300 wrote to memory of 3680	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	93
PID 2300 wrote to memory of 3680	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	93
PID 2300 wrote to memory of 3680	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	93
PID 2300 wrote to memory of 3504	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	95
PID 2300 wrote to memory of 3504	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	95
PID 2300 wrote to memory of 3504	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	95
PID 2300 wrote to memory of 1744	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	97
PID 2300 wrote to memory of 1744	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	97
PID 2300 wrote to memory of 1744	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	97
PID 2300 wrote to memory of 744	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	98
PID 2300 wrote to memory of 744	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	98
PID 2300 wrote to memory of 956	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	99
PID 2300 wrote to memory of 956	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	99
PID 2300 wrote to memory of 956	2300	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	99
PID 956 wrote to memory of 372	956	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	100
PID 956 wrote to memory of 372	956	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	100
PID 956 wrote to memory of 372	956	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	100
PID 956 wrote to memory of 372	956	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	100
PID 956 wrote to memory of 372	956	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	100
PID 956 wrote to memory of 372	956	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	100
PID 956 wrote to memory of 372	956	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	100
PID 956 wrote to memory of 372	956	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	100
PID 372 wrote to memory of 4776	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	101
PID 372 wrote to memory of 4776	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	101
PID 372 wrote to memory of 4776	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	101
PID 372 wrote to memory of 4596	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	102
PID 372 wrote to memory of 4596	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	102
PID 372 wrote to memory of 4596	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	102
PID 372 wrote to memory of 3160	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	104
PID 372 wrote to memory of 3160	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	104
PID 372 wrote to memory of 3160	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	104
PID 372 wrote to memory of 2364	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	105
PID 372 wrote to memory of 2364	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	105
PID 372 wrote to memory of 2364	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	105
PID 372 wrote to memory of 4972	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	106
PID 372 wrote to memory of 4972	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	106
PID 372 wrote to memory of 4972	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	106
PID 372 wrote to memory of 536	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	107
PID 372 wrote to memory of 536	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	107
PID 372 wrote to memory of 536	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	107
PID 372 wrote to memory of 4236	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	108
PID 372 wrote to memory of 4236	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	108
PID 372 wrote to memory of 4236	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	108
PID 372 wrote to memory of 4956	372	11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe	111

C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:744
- - C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        6⤵
        Checks computer location settings
        
        PID:2476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:1332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        8⤵
        Checks computer location settings
        
        PID:4200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        9⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        10⤵
        Checks computer location settings
        
        PID:1236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:5016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        11⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        12⤵
        Checks computer location settings
        
        PID:4380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:3452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:2776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:1092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:1436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:1664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        13⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        14⤵
        Checks computer location settings
        
        PID:1652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:2496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:1900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:1916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:2472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        15⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        16⤵
        Checks computer location settings
        
        PID:1924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:2476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:2600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:4232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:4244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:4584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:4580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:4816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        17⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        18⤵
        Checks computer location settings
        
        PID:3728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:4656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:1508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:2872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:3464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:4060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:4616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        19⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        20⤵
        Checks computer location settings
        
        PID:4148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:1604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:4480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:3604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:4760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:1812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:1528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:4536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        21⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        22⤵
        Checks computer location settings
        
        PID:380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:3472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:4228
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:3928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:4632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:4900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:3124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:5068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        23⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        24⤵
        Checks computer location settings
        
        PID:3060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:4560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:2588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:2300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:1652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:2336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        25⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        26⤵
        Checks computer location settings
        
        PID:1084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:4976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:2424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:2516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:4276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:2420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:2176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        27⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        28⤵
        Checks computer location settings
        
        PID:4140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:4552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:4992
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:4328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:1524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:3044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:4340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:3480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        29⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        30⤵
        Checks computer location settings
        
        PID:1100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:2328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:3080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:1620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:4800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:5080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:3252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        31⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        32⤵
        Checks computer location settings
        
        PID:1544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:2212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:5012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:4940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:2332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:3908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:4360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        33⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        34⤵
        Checks computer location settings
        
        PID:4852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:1704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:4476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:4016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:1956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:3696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:2024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:1600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        35⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        36⤵
        Checks computer location settings
        
        PID:2784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:1920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:4876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:3972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:4032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:2804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:1424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:3076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        37⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        38⤵
        Checks computer location settings
        
        PID:2036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:3644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:4200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:4864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:2180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:1084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        39⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        40⤵
        Checks computer location settings
        
        PID:4660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:2392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:4852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:3700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:3428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:1648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:4884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:1556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        41⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        42⤵
        Checks computer location settings
        
        PID:716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:5076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:2704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:2236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:4520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:2740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        43⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        44⤵
        Checks computer location settings
        
        PID:380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:2896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:2028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:1844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:3600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:2916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:4564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:2980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        45⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        46⤵
        Checks computer location settings
        
        PID:4544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:5032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:4668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:2076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:2920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:1100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:3980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        47⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        48⤵
        Checks computer location settings
        
        PID:2084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:2784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:3228
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:1628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:2068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:2456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:4660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        49⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        50⤵
        Checks computer location settings
        
        PID:2956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:3888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:1880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:1800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:4280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:5124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:5132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        51⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        52⤵
        Checks computer location settings
        
        PID:5200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:5256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:5268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:5288
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:5300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:5308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:5320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:5328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        53⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        54⤵
        Checks computer location settings
        
        PID:5388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:5444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:5464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:5472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:5484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:5492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:5504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:5512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        55⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        56⤵
        Checks computer location settings
        
        PID:5576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:5632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:5640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:5652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:5808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:5880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:5888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:5900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        57⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        58⤵
        Checks computer location settings
        
        PID:5964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        59⤵
        
        PID:6020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        59⤵
        
        PID:6028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        59⤵
        
        PID:6040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        59⤵
        
        PID:6048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        59⤵
        
        PID:6060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        59⤵
        
        PID:6068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        59⤵
        
        PID:6080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        59⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        59⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        60⤵
        Checks computer location settings
        
        PID:6140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        61⤵
        
        PID:5196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        61⤵
        
        PID:5176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        61⤵
        
        PID:5184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        61⤵
        
        PID:5180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        61⤵
        
        PID:5248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        61⤵
        
        PID:5244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        61⤵
        
        PID:5280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        61⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe"
        61⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\11d49abeff7a0511210c37c901b1cff3_JaffaCakes118.exe
        
        62⤵
        
        PID:5204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        63⤵
        
        PID:5364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        63⤵
        
        PID:5420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        63⤵
        
        PID:5440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        63⤵
        
        PID:2952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        63⤵
        
        PID:1232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        63⤵
        
        PID:4452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        63⤵
        
        PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

((Mutex)).cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg
Size 1KB
SHA256 10e574f6f74e1ca526e2cdf6d113bbadeba2c2ff31cc30ffa51c8078fa087821
MD5 d27d71e035ca15d37f34077b8a52ebcb
SHA1 9551cbd771877f520c2016fe413aa315c098dc98
SHA512 dbc0842c16ab8167edbd15a54179527dfc06a76c867a20850a09ad1fff8deabf118f9871133fccaef009a6ae8c07a0682652ad533ec1240067f6daedb5c925b1
MD5 SHA1 SHA512

Submit Download

memory/372-25-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/372-21-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/372-17-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/372-20-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/440-179-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/956-19-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1084-135-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1084-136-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1236-51-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1236-50-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1260-36-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1260-43-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1652-73-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1652-75-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1740-224-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1740-230-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1800-199-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2076-31-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2300-8-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2300-12-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2300-9-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2300-5-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2300-3-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2320-219-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2456-53-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2476-29-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2476-32-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2724-209-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2864-239-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3032-127-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3060-128-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3060-126-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3080-85-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3428-111-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3428-118-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3540-96-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3540-90-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3604-64-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3604-57-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3640-159-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3640-153-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3644-169-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4120-102-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4120-107-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4368-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4368-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4436-74-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4436-68-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4532-250-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4532-244-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4640-260-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4688-147-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4788-189-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4968-138-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5172-271-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5172-266-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5316-324-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5364-282-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5548-286-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5548-293-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5936-297-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5936-303-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/6116-314-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads