xtremerat | c634146cab69b72a71fa13a9ab8d3fd46b57e26cd40351b1bb5f0f17851685fe

Analysis

max time kernel
150s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 00:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Size 3.4MB
Sample240708-axyw6awejf
SHA256 c634146cab69b72a71fa13a9ab8d3fd46b57e26cd40351b1bb5f0f17851685fe
MD5 2a5d1b4da7de5b8157e41ffd53c585f4
SHA1 7f7a1b1d01ce096109aafbb936f2604b2894d031
SHA512 bd9a8c5b317398aa6a842f3803b035f80208a586c9176912b4acbedabca943860d683dcb911aa29b169074ca801334ba849a8caf970aa6f933180cbc827b95c8
SSDEEP 49152:BuOtOM28qS/JbVPS2PPJGAm+KhWbyZVtgk1KDmcv+ZZ9Waa0l/TbQVKaOto22K:lOMZZHP3PPahyy1yA9Waaw/KOm22K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

mmsalt.no-ip.org

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/3272-19-0x0000000010000000-0x000000001015D000-memory.dmp	family_xtremerat
behavioral2/memory/3272-21-0x0000000010000000-0x000000001015D000-memory.dmp	family_xtremerat
behavioral2/memory/3272-48-0x0000000010000000-0x000000001015D000-memory.dmp	family_xtremerat
behavioral2/memory/3272-22-0x0000000010000000-0x000000001015D000-memory.dmp	family_xtremerat
behavioral2/memory/4552-49-0x0000000010000000-0x000000001015D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Checks BIOS information in registry 2 TTPs 64 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2872 set thread context of 3272	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	88
PID 2872 set thread context of 4088	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	96
PID 2640 set thread context of 1600	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	98
PID 2640 set thread context of 772	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	105
PID 4972 set thread context of 4104	4972	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	107
PID 4972 set thread context of 4044	4972	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	114
PID 4416 set thread context of 4464	4416	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	116
PID 4416 set thread context of 3952	4416	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	123
PID 3388 set thread context of 4660	3388	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	125
PID 3388 set thread context of 2836	3388	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	132
PID 3136 set thread context of 3464	3136	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	134
PID 3136 set thread context of 2192	3136	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	141
PID 2844 set thread context of 4856	2844	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	143
PID 2844 set thread context of 1420	2844	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	150
PID 4916 set thread context of 4928	4916	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	154
PID 4916 set thread context of 5016	4916	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	161
PID 2884 set thread context of 3228	2884	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	163
PID 2884 set thread context of 888	2884	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	170
PID 2364 set thread context of 2140	2364	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	172
PID 2364 set thread context of 1680	2364	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	179
PID 2252 set thread context of 3084	2252	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	182
PID 2252 set thread context of 3052	2252	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	189
PID 2120 set thread context of 1056	2120	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	191
PID 2120 set thread context of 4296	2120	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	198
PID 864 set thread context of 2116	864	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	200
PID 864 set thread context of 2880	864	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	207
PID 3096 set thread context of 3148	3096	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	209
PID 3096 set thread context of 220	3096	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	216
PID 2916 set thread context of 3648	2916	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	218
PID 2916 set thread context of 964	2916	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	225
PID 4264 set thread context of 3300	4264	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	227
PID 4264 set thread context of 2296	4264	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	234
PID 1372 set thread context of 4428	1372	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	236
PID 1372 set thread context of 3508	1372	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	243
PID 1580 set thread context of 100	1580	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	245
PID 1580 set thread context of 2512	1580	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	252
PID 4324 set thread context of 4368	4324	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	254
PID 4324 set thread context of 4396	4324	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	261
PID 4104 set thread context of 4408	4104	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	263
PID 4104 set thread context of 2380	4104	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	270
PID 3024 set thread context of 3212	3024	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	272
PID 3024 set thread context of 2348	3024	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	279
PID 1600 set thread context of 4004	1600	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	281
PID 1600 set thread context of 100	1600	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	288
PID 1468 set thread context of 4332	1468	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	290
PID 1468 set thread context of 4368	1468	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	297
PID 2412 set thread context of 2480	2412	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	299
PID 2412 set thread context of 5032	2412	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	306
PID 4524 set thread context of 3304	4524	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	308
PID 4524 set thread context of 2064	4524	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	315
PID 1688 set thread context of 1460	1688	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	317
PID 1688 set thread context of 228	1688	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	324
PID 1900 set thread context of 4032	1900	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	326
PID 1900 set thread context of 684	1900	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	333
PID 392 set thread context of 2228	392	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	335
PID 392 set thread context of 2640	392	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	342
PID 1604 set thread context of 1732	1604	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	344
PID 1604 set thread context of 2496	1604	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	351
PID 5104 set thread context of 4780	5104	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	353
PID 5104 set thread context of 2448	5104	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	360
PID 4900 set thread context of 4860	4900	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	362
PID 4900 set thread context of 3264	4900	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	369
PID 4032 set thread context of 4684	4032	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	371
PID 4032 set thread context of 4588	4032	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	378

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\175Imogen_ThomasSexy_Photoshoot_09.jpg.exe	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
File created	C:\Windows\175Imogen_ThomasSexy_Photoshoot_09.jpg	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
4092	4552	WerFault.exe	89
1252	4552	WerFault.exe	89
1372	4656	WerFault.exe	99
3212	4656	WerFault.exe	99
2252	100	WerFault.exe	108
3132	100	WerFault.exe	108
512	4368	WerFault.exe	117
4756	4368	WerFault.exe	117
4068	2888	WerFault.exe	126
368	2888	WerFault.exe	126
4656	4880	WerFault.exe	135
4256	4880	WerFault.exe	135
4260	3988	WerFault.exe	144
5068	3988	WerFault.exe	144
3476	4432	WerFault.exe	155
2096	4432	WerFault.exe	155
2236	4748	WerFault.exe	164
1672	4748	WerFault.exe	164
1532	3428	WerFault.exe	173
4004	3428	WerFault.exe	173
968	4992	WerFault.exe	183
2044	4992	WerFault.exe	183
2268	2040	WerFault.exe	192
1848	2040	WerFault.exe	192
3636	2884	WerFault.exe	201
468	2884	WerFault.exe	201
5068	992	WerFault.exe	210
3928	992	WerFault.exe	210
4172	2400	WerFault.exe	219
1776	2400	WerFault.exe	219
4012	4248	WerFault.exe	228
4496	4248	WerFault.exe	228
3644	3348	WerFault.exe	237
3464	3348	WerFault.exe	237
1664	2028	WerFault.exe	246
4036	2028	WerFault.exe	246
2252	2588	WerFault.exe	255
1636	2588	WerFault.exe	255
3292	4248	WerFault.exe	264
916	4248	WerFault.exe	264
2080	3788	WerFault.exe	273
1268	3788	WerFault.exe	273
2028	3204	WerFault.exe	282
1968	3204	WerFault.exe	282
4092	512	WerFault.exe	291
3156	512	WerFault.exe	291
1464	1980	WerFault.exe	300
1252	1980	WerFault.exe	300
1928	436	WerFault.exe	309
1744	436	WerFault.exe	309
2952	1864	WerFault.exe	318
4080	1864	WerFault.exe	318
3964	1736	WerFault.exe	327
1588	1736	WerFault.exe	327
3456	3636	WerFault.exe	336
2884	3636	WerFault.exe	336
3284	4424	WerFault.exe	345
4524	4424	WerFault.exe	345
4080	1600	WerFault.exe	354
4620	1600	WerFault.exe	354
3172	3964	WerFault.exe	363
2252	3964	WerFault.exe	363
5028	4936	WerFault.exe	372
1168	4936	WerFault.exe	372

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\InProcServer32	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\InProcServer32\ = "%SystemRoot%\\SysWow64\\shell32.dll"	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\ = "Microsoft AutoComplete"	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\InProcServer32\ThreadingModel = "Apartment"	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	4972	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4972	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	4416	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4416	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	3388	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3388	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	3136	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3136	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	2844	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2844	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	4916	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4916	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	2884	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2884	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	2364	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2364	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	2252	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2252	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	2120	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2120	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	864	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	864	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	3096	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3096	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	2916	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2916	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	4264	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4264	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	1372	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1372	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	1580	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1580	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	4324	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4324	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	4104	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4104	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	3024	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3024	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	1600	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1600	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	1468	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1468	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	2412	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2412	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	4524	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4524	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	1688	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1688	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	1900	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1900	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	392	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	392	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	1604	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1604	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	5104	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	5104	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	4900	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4900	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: 33	4032	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4032	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 37 IoCs

pid	Process
2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
4972	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
4416	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
3388	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
3136	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
2844	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
4916	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
2884	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
2364	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
2252	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
2120	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
864	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
3096	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
2916	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
4264	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
1372	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
1580	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
4324	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
4104	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
3024	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
1600	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
1468	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
2412	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
4524	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
1688	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
1900	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
392	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
1604	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
5104	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
4900	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
4032	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
2548	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
4752	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
1140	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
2328	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
4352	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2872	2040	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	84
PID 2040 wrote to memory of 2872	2040	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	84
PID 2040 wrote to memory of 2872	2040	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	84
PID 2872 wrote to memory of 3272	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	88
PID 2872 wrote to memory of 3272	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	88
PID 2872 wrote to memory of 3272	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	88
PID 2872 wrote to memory of 3272	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	88
PID 2872 wrote to memory of 3272	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	88
PID 2872 wrote to memory of 3272	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	88
PID 2872 wrote to memory of 3272	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	88
PID 2872 wrote to memory of 3272	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	88
PID 2872 wrote to memory of 3272	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	88
PID 2872 wrote to memory of 3272	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	88
PID 2872 wrote to memory of 3272	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	88
PID 2872 wrote to memory of 3272	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	88
PID 2872 wrote to memory of 3272	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	88
PID 3272 wrote to memory of 4552	3272	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	89
PID 3272 wrote to memory of 4552	3272	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	89
PID 3272 wrote to memory of 4552	3272	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	89
PID 3272 wrote to memory of 4552	3272	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	89
PID 3272 wrote to memory of 4876	3272	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	90
PID 3272 wrote to memory of 4876	3272	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	90
PID 3272 wrote to memory of 4876	3272	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	90
PID 2872 wrote to memory of 4088	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	96
PID 2872 wrote to memory of 4088	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	96
PID 2872 wrote to memory of 4088	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	96
PID 2872 wrote to memory of 4088	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	96
PID 2872 wrote to memory of 4088	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	96
PID 2872 wrote to memory of 4088	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	96
PID 2872 wrote to memory of 4088	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	96
PID 2872 wrote to memory of 4088	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	96
PID 2872 wrote to memory of 4088	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	96
PID 2872 wrote to memory of 4088	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	96
PID 2872 wrote to memory of 4088	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	96
PID 2872 wrote to memory of 4088	2872	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	96
PID 4088 wrote to memory of 2640	4088	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	97
PID 4088 wrote to memory of 2640	4088	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	97
PID 4088 wrote to memory of 2640	4088	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	97
PID 2640 wrote to memory of 1600	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	98
PID 2640 wrote to memory of 1600	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	98
PID 2640 wrote to memory of 1600	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	98
PID 2640 wrote to memory of 1600	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	98
PID 2640 wrote to memory of 1600	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	98
PID 2640 wrote to memory of 1600	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	98
PID 2640 wrote to memory of 1600	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	98
PID 2640 wrote to memory of 1600	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	98
PID 2640 wrote to memory of 1600	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	98
PID 2640 wrote to memory of 1600	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	98
PID 2640 wrote to memory of 1600	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	98
PID 2640 wrote to memory of 1600	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	98
PID 2640 wrote to memory of 1600	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	98
PID 1600 wrote to memory of 4656	1600	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	99
PID 1600 wrote to memory of 4656	1600	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	99
PID 1600 wrote to memory of 4656	1600	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	99
PID 1600 wrote to memory of 4656	1600	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	99
PID 1600 wrote to memory of 1180	1600	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	100
PID 1600 wrote to memory of 1180	1600	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	100
PID 1600 wrote to memory of 1180	1600	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	100
PID 2640 wrote to memory of 772	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	105
PID 2640 wrote to memory of 772	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	105
PID 2640 wrote to memory of 772	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	105
PID 2640 wrote to memory of 772	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	105
PID 2640 wrote to memory of 772	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	105
PID 2640 wrote to memory of 772	2640	2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe	105

C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe"
  2⤵
  - Checks BIOS information in registry
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4552
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 200
        5⤵
        Program crash
        
        PID:4092
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 208
        5⤵
        Program crash
        
        PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4876
- - C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
      4⤵
      Checks BIOS information in registry
      Suspicious use of SetThreadContext
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1600
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 200
        7⤵
        Program crash
        
        PID:1372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 208
        7⤵
        Program crash
        
        PID:3212
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        5⤵
        
        PID:772
      - C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        6⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        7⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        8⤵
        
        PID:100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 200
        9⤵
        Program crash
        
        PID:2252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 208
        9⤵
        Program crash
        
        PID:3132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        7⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        8⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        9⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        10⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 200
        11⤵
        Program crash
        
        PID:512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 208
        11⤵
        Program crash
        
        PID:4756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        9⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        10⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        11⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        12⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 200
        13⤵
        Program crash
        
        PID:4068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 208
        13⤵
        Program crash
        
        PID:368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        11⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        12⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        13⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        14⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 200
        15⤵
        Program crash
        
        PID:4656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 208
        15⤵
        Program crash
        
        PID:4256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        13⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        14⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        15⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        16⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 200
        17⤵
        Program crash
        
        PID:4260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 208
        17⤵
        Program crash
        
        PID:5068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        15⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        16⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        17⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        18⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 200
        19⤵
        Program crash
        
        PID:3476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 208
        19⤵
        Program crash
        
        PID:2096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        17⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        18⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        19⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        20⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 200
        21⤵
        Program crash
        
        PID:2236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 208
        21⤵
        Program crash
        
        PID:1672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        19⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        20⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        21⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        22⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 200
        23⤵
        Program crash
        
        PID:1532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 208
        23⤵
        Program crash
        
        PID:4004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        21⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        22⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        23⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        24⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 200
        25⤵
        Program crash
        
        PID:968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 208
        25⤵
        Program crash
        
        PID:2044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        23⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        24⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        25⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        26⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 200
        27⤵
        Program crash
        
        PID:2268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 208
        27⤵
        Program crash
        
        PID:1848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        25⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        26⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        27⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        28⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 200
        29⤵
        Program crash
        
        PID:3636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 208
        29⤵
        Program crash
        
        PID:468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        27⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        28⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        29⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        30⤵
        
        PID:992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 200
        31⤵
        Program crash
        
        PID:5068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 208
        31⤵
        Program crash
        
        PID:3928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        29⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        30⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        31⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        32⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 200
        33⤵
        Program crash
        
        PID:4172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 208
        33⤵
        Program crash
        
        PID:1776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        32⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        31⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        32⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        33⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        34⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 200
        35⤵
        Program crash
        
        PID:4012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 208
        35⤵
        Program crash
        
        PID:4496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        34⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        33⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        34⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        35⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        36⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 200
        37⤵
        Program crash
        
        PID:3644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 208
        37⤵
        Program crash
        
        PID:3464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        36⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        35⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        36⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        37⤵
        
        PID:100
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        38⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 200
        39⤵
        Program crash
        
        PID:1664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 208
        39⤵
        Program crash
        
        PID:4036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        38⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        37⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        38⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        39⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        40⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 200
        41⤵
        Program crash
        
        PID:2252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 208
        41⤵
        Program crash
        
        PID:1636
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        40⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        39⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        40⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        41⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        42⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 200
        43⤵
        Program crash
        
        PID:3292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 208
        43⤵
        Program crash
        
        PID:916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        42⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        41⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        42⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        43⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        44⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 200
        45⤵
        Program crash
        
        PID:2080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 208
        45⤵
        Program crash
        
        PID:1268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        44⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        43⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        44⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        45⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        46⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 200
        47⤵
        Program crash
        
        PID:2028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 208
        47⤵
        Program crash
        
        PID:1968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        46⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        45⤵
        
        PID:100
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        46⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        47⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        48⤵
        
        PID:512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 200
        49⤵
        Program crash
        
        PID:4092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 208
        49⤵
        Program crash
        
        PID:3156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        48⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        47⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        48⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        49⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        50⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 200
        51⤵
        Program crash
        
        PID:1464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 208
        51⤵
        Program crash
        
        PID:1252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        50⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        49⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        50⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        51⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        52⤵
        
        PID:436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 200
        53⤵
        Program crash
        
        PID:1928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 208
        53⤵
        Program crash
        
        PID:1744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        52⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        51⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        52⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        53⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        54⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 200
        55⤵
        Program crash
        
        PID:2952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 208
        55⤵
        Program crash
        
        PID:4080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        54⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        53⤵
        
        PID:228
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        54⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        55⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        56⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 200
        57⤵
        Program crash
        
        PID:3964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 208
        57⤵
        Program crash
        
        PID:1588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        56⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        55⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        56⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        57⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        58⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 200
        59⤵
        Program crash
        
        PID:3456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 208
        59⤵
        Program crash
        
        PID:2884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        58⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        57⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        58⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        59⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        60⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 200
        61⤵
        Program crash
        
        PID:3284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 208
        61⤵
        Program crash
        
        PID:4524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        60⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        59⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        60⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        61⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        62⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 200
        63⤵
        Program crash
        
        PID:4080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 208
        63⤵
        Program crash
        
        PID:4620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        62⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        61⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        62⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        63⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        64⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 200
        65⤵
        Program crash
        
        PID:3172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 208
        65⤵
        Program crash
        
        PID:2252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        64⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        63⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        64⤵
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        65⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        66⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 200
        67⤵
        Program crash
        
        PID:5028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 208
        67⤵
        Program crash
        
        PID:1168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        66⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        65⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        66⤵
        Checks BIOS information in registry
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        67⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        68⤵
        
        PID:992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 200
        69⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 208
        69⤵
        
        PID:4116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        68⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        67⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        68⤵
        Checks BIOS information in registry
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        69⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        70⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 200
        71⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 208
        71⤵
        
        PID:4828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        70⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        69⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        70⤵
        Checks BIOS information in registry
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        71⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        72⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 200
        73⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 208
        73⤵
        
        PID:2812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        72⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        71⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        72⤵
        Checks BIOS information in registry
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        73⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        74⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 200
        75⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 208
        75⤵
        
        PID:2576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        74⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        73⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        74⤵
        Checks BIOS information in registry
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a5d1b4da7de5b8157e41ffd53c585f4_JaffaCakes118.exe
        75⤵
        
        PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4552 -ip 4552
1⤵
PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4552 -ip 4552
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4656 -ip 4656
1⤵
PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4656 -ip 4656
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 100 -ip 100
1⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 100 -ip 100
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4368 -ip 4368
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4368 -ip 4368
1⤵
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2888 -ip 2888
1⤵
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2888 -ip 2888
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4880 -ip 4880
1⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4880 -ip 4880
1⤵
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3988 -ip 3988
1⤵
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3988 -ip 3988
1⤵
PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4432 -ip 4432
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4432 -ip 4432
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4748 -ip 4748
1⤵
PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4748 -ip 4748
1⤵
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 3428 -ip 3428
1⤵
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3428 -ip 3428
1⤵
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4992 -ip 4992
1⤵
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4992 -ip 4992
1⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 2040 -ip 2040
1⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 2040 -ip 2040
1⤵
PID:1832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2884 -ip 2884
1⤵
PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2884 -ip 2884
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 992 -ip 992
1⤵
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 992 -ip 992
1⤵
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2400 -ip 2400
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 2400 -ip 2400
1⤵
PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 4248 -ip 4248
1⤵
PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4248 -ip 4248
1⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3348 -ip 3348
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3348 -ip 3348
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 2028 -ip 2028
1⤵
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2028 -ip 2028
1⤵
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2588 -ip 2588
1⤵
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 2588 -ip 2588
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4248 -ip 4248
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4248 -ip 4248
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3788 -ip 3788
1⤵
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3788 -ip 3788
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3204 -ip 3204
1⤵
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 3204 -ip 3204
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 512 -ip 512
1⤵
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 512 -ip 512
1⤵
PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1980 -ip 1980
1⤵
PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 1980 -ip 1980
1⤵
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 436 -ip 436
1⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 436 -ip 436
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1864 -ip 1864
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 1864 -ip 1864
1⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1736 -ip 1736
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 1736 -ip 1736
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 3636 -ip 3636
1⤵
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3636 -ip 3636
1⤵
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4424 -ip 4424
1⤵
PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4424 -ip 4424
1⤵
PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1600 -ip 1600
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 1600 -ip 1600
1⤵
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 3964 -ip 3964
1⤵
PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 3964 -ip 3964
1⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 4936 -ip 4936
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 4936 -ip 4936
1⤵
PID:2732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 992 -ip 992
1⤵
PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 992 -ip 992
1⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 3992 -ip 3992
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 3992 -ip 3992
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 1736 -ip 1736
1⤵
PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 1736 -ip 1736
1⤵
PID:1772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5072 -ip 5072
1⤵
PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 5072 -ip 5072
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 1770c381967e9713031d8ede1798061b517fd20918be3f807778979c2082de9f
MD5 9af66fe7f670dfa46205fabb1d38eb09
SHA1 191b1c7d2cff2c56e86da9564e8320d69e1ed480
SHA512 a6dfe3111bbd7cb7024bb67ff019851dcf1116dbf459337e74ef370b5fb27c3c1bde078aaa3ec75032493531b38b802a539d409c6eba88a048be03c847f4198d
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 05cf07476dba80d7fe4c0b799e67f09cd2c9a77763ee9b34affdcd3c941d3337
MD5 389307c791abb1c389357a212e8d2b42
SHA1 d89fd68e465e8d0e284e765ee68d879c7853cd24
SHA512 06e556eba74be92fd88fd2aace4967f018e60b6f86a8cc71beb7d80061e8bb3009b1749308185d7a04204b03b76d03721a4080bdd7a9eac858a0c6b8041c6003
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 d6f4a45f1b38f48e730c8fbd3956e4603ad87064c19020a27c72c1928edfe1cf
MD5 9476d8a52227d918378315916f7f987a
SHA1 6a13578939b4b24837999ce39c48a12562fdccb3
SHA512 67e9996d7bf0af1dbb03b65cc0f10853a76f7df6106ca92fc61fbdd79068230d52578ef8ac405b9894dd7d2002bf8e65db76bc33b4c48c51a40b9d42975c6706
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 5187c92512303f9bf9f7510c96a989c9e39f38cbe2f463a4cf953a9f2ef344c8
MD5 ffb446d576e0726f972b2ce8892c05f4
SHA1 a5f2c2de0e67b0270eb48b888eb07004994edf6e
SHA512 a2100eddcb63a35e256a23c7453cfa903d2bfcc775599b29de175636bcff2267395e1820d785dc4a1a07d56a82d66ac437b848ed978bab21c46244fa5202522f
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 69c30b924fca3928b7e2329eb45b2ed1ed5869b5a6d1671f4f3ca75b088501d2
MD5 ec931b0f07e2f6d348cfc6b5d4798280
SHA1 31cc6e204a036d96c7b2705c7fedc69c079e9ec6
SHA512 14455d713cc0046f0dbc84941f5a9ba9a057bb8a4abc284bcc635c805a8d420e6feb4bfa428cc330e5518a58d5cf1582463ad25ca5a14020a75cdf4ce30ab704
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 29c838b97f8967c1d3fbec03aae1f375d8e40dfbdee30f3364ec3d7fd7fce385
MD5 3022d01b05ed105e6a457d4b49b80b7a
SHA1 57007d24a5209d0d5ac742339737aa8ff4d81faa
SHA512 26fdef9b62b4dbd03e894552c2ac12e94019abdb568c221ef0688d76975cdcb55b86eb4502ac50549ad2eb1836973a95d46bd913132f3f42c7ad8636127466c4
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 472dda519ad0134ca3e0004a3d75b7ae312c5e5461de84bf6f0e877a10b9d24e
MD5 8c125efec6b8c2d6783a449e59db0ec6
SHA1 bb80d8acff29e526a8508ebf34d8e4a35dd1dd85
SHA512 5a1aeefbd09de94d978a98af67e8e52c912415e4e4320046ddcac8aed2b7c79b2927b8868f7ff58f276bf2f0332968d506be544a45edcfd750d91d9e1fce6a73
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 d2056333d3609e8c1f8aec863fb25c8f30c65457acec44de728ec36500bca22d
MD5 dbdacc50a06d77c683eb84a34b163036
SHA1 8d49464050c586a888a0fd885cee0e425d3d58ed
SHA512 5fe890ef3bec3e09e062e55a21c73a1c32b1e4feddca4e120cd84cf335ed252578d1fd66a417d5ca9e6f79a49654389e03f55365e8681a00453df81404c7c24a
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 fc63c046fc9f744bcbc467a73e6f3634590439db2b130b35687987d913d45374
MD5 62845bf44a3f5d1d274f2cf869bf2324
SHA1 c29067f081f07917a006deed0c1cd47f6df10c4b
SHA512 1ad202e78e5551a7bcd2d3c44eb75d15acee3907afff74f6c93856dba15c3b8d61205353128064562011e21fca9c7ec062e4e273c0d16e11d2928a4e1f2a8e71
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 844170858b74c3e4adde07d20f71468abd069b7b52920b1fa44514b899832da6
MD5 bb49e50de2e957845cb3686cfa709b60
SHA1 d02961d50fdfec08448b3dfab0726c95d63f662d
SHA512 cb2d5c2a616aca0830a10098dbbf36c3c2ae60498d98a1f891b7e018f08a55237c5adb5f0caa1dfe3ca58d51cc38c58417933dc3de0a67004bba8f398f3797ea
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 1f7616530b61c8ce401fab1c3ab5589004bbb2ca3b9dd9b19006ec4dd5340131
MD5 8817545325ac669c565df3e79d2809bb
SHA1 70f984a13ea0dff4ccc3fa2de6d1fa8a56386329
SHA512 85b7a956e3c78a150fa26604e731be1e0c3ffea63dac7fbb00a5f13308798f472ebeb1d109429234883143444a807d2a035acbb1cfa0b9c757af18fccde96ce9
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 d26ea3bb3d9c6eb7b47231196c2ffb5768d969c70bdc703d90629a8c11ae6bd4
MD5 0ce45e20cee4ac7e32f3c80a53adb62b
SHA1 b1f50e9005e60dbe077a68c2ea8be9f2b8efb180
SHA512 f2ff12e0496068039f57f6ed21a260b280f1ec2c39539a04635db9f3dfbaa9fef3e4b910931ef862869a7619f52b83d85a255ee7a203f8320af0aebd3ae58422
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 60d4a10b4a72b45ec9dec67413e9e90922acb09e113aeeada56b32b85a12dbb1
MD5 44d19d14666ea4c1139a2a5a0a24fd2e
SHA1 d93bcf5849fcb60357e38c8710b17aa505b7a6a5
SHA512 74a3a781d6231923ddd3b74df5ea005e03f28a1e8ea6a63ee34bb8aee039a80269b8cef6007ca052f0ee17ecfcda70aaae645391d827f4238fd55bfea3068b7a
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 89b6b01cdfa0ebb8f9303a26ea989e6bc7558e2037df0bd681a96ff860376d08
MD5 965c0044abc95e0107732f5a2adf854e
SHA1 f9b4d5cab3451a7828993d14f0a18bde604ec077
SHA512 b0ec91252950ce829e8232203a8075b025249ecc4414b7d5a7e07bd2433658112202b6c550628e994061d4dd58a4b7638c9a93c863ea80b3c5fa02be4d7dfb02
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 efeb394b0b0a3a6f039f5c9984c0fe80419e2fe3081f431f5f6fcc7298d9559b
MD5 e7cba316cc709010b5fe58332eccd7f6
SHA1 82b1d01e2c2efc28fb16d1784b0e92d334d0e70d
SHA512 0d87a2cb4e93ff4e22df90f1a51691e22056857ca4b72ae4c12fb56a86dee63a47d5c988c209ed6100bb635f1c340bd66f96c1ec521ab46911324864ee2f8504
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 e8c6a11f1b1e0bce97ec53051a11911b2b615d682244f0a0c9d703d446553198
MD5 51719c8772887f6d143793918b9ed12d
SHA1 5632515cbbab1207cb3cc1c0e6c802de880f09a9
SHA512 09564f1632c4890920ae7238a982217ad09d0fb7638411d1b3b757c95fd936159dc6fd485235ca6a8f987e96310beea9f7f2ed37d5a426e68a9239b1c571f5f7
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 e27a18181115a58a9b19eeebe0c56d2cc74a44dfccc9c7cc61e43ad38ceff8a6
MD5 f06a418fbdb7bf8629f2e773f25757d4
SHA1 a2064d93fb9a3fcb9b5b7eede69e4bde8b90a1b5
SHA512 08739841b67334d632aa2e301d293a8a387a44cf0594fed89faa67dd239b888065e60aaf5f4aa168d6707d910127110f21a45968d193f5324a7d2b3ac7868263
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 cfe33d5ed301bda222bbfaf178299d503ae6d4d3fceeb3e3e96ee155846e59bf
MD5 a3896d29533bacfe176a5e2478dedcde
SHA1 f56d8932ddfc54a22f5e9bfcdf301635c3cbb50d
SHA512 3b25e0a3ee2824188cce124c96260aa94ead1e419030e0bd612fbff43e7b0e3c3510fdb82fedeb03dc0011ed328b16084f96e9dc0f23ca8dd30d3e7f29a71b5b
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 104dc9b392be10ef1307fa962c2044cbb1299d2e8dda4faab19eae99163a53f4
MD5 660d6ceec5f85043b936bc8408148081
SHA1 82a26b4e517acfde3123dde625deef178dedf393
SHA512 e3fbffe0812a1d105c66fcb04f427ea32f3bd6d1f7d7cbd0b45e34a83ff8e72d08dfb5bf7b90d258e2cc5ab6c77614a6e5a65b2acc57413aee751f5a6b26273b
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 d1925b16687efeffa02e68b159caa7a8cdaec1c4a859cde374b5141f6b9758ba
MD5 a71bf07e2cfe1e3440506f04bdadd520
SHA1 d1b5a1ece13623e7589916ec8ed3e5529b05be15
SHA512 30afc0899b2585aa203f7f7200b0740faa43148cf1a86191abaeb3841846d1acbe1cb340d41ad0ed5e9520bfa99638689fde27268454e3978164ec70f79a8cb8
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 86b846a98c9cbf41be2a0d5ede95a5549b4943b1cb79bf8dbd9c6f97d61c5ad2
MD5 0bd077866df89ef8066d34c272109261
SHA1 c095ecdc9acd785efbf01a5ef5f10300f791f15a
SHA512 519703045c433b0bf0255e42c3fb58f481b538cc8e891c644201d6ae391e08983c7899bbe42de62cb1c4a24da22108710e45484165c926c40d069102b900d905
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 fa4c406707506e6be7e23ed69fdf8b1ad53387c7471441c5506c55057c84ccb4
MD5 d09823e536d2d182d8e32a25d86e99e7
SHA1 d9ad1a8c97a0c053277cb35034ab5e1dad4efb3d
SHA512 32566b7ff89f85bff7dc5952caf9d09a970e4e343ef9b403e31cc62ec06ebaaacae79653bbdf7d97599e259505fba3364fce31ef563364058997cbfdf02de4fe
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 e1f5271f0c30ff9af65a05fbd53da549214010a1871b37605b7315721820dffb
MD5 af5e209462e4071888b8dcf5e7c29b3b
SHA1 e88c541737f88368dbdbe57cbac5edcfbb72be82
SHA512 5c649e3b5cd06cb3c07ae5737d26ae8434a80a5155ffcfd30cbf5ed5425c66ccb0b9a83c146dbc8a9b6e9a1067933251b0fabb2a97e79381e7e63a7fce2ddc90
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 242b3247831e2b80442da709932887b835d6af71c3bae58c9db6d5a7d940cb05
MD5 99957f083390b33f0ba24d0bffe54e5c
SHA1 35a42ad5df1a29707284937892d3a592219f19fa
SHA512 fd06d648603e93dd722f360ea9c799a89559be93560fa74fb753fa9c3000efc598aadcb82cc8d60b628c3a6c0203ca50f1b139e53ec8d6e32db2683b0d8000ac
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 fbbbc3b7fb53106703ee7e69750ca4f90690475615779c5f10341ba660b39bd1
MD5 aa0dd164d6c5e4955b994e50837abb3c
SHA1 bd178c37a927ca72890ac539289319bcf280a568
SHA512 e4df858b37a8ac15b2efd12fcc7987208cd1d7a4366e6e8378c1a99f9c8e2db5e773ddb20d6574ceed94ec144190ba2a777bff8c42f7e33c8396ea1278ba0438
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 1bbb4a2cac4182b5f56f5551f5a481da3051d05ade363e8de75001af02d3ea87
MD5 621562b9d36ea992a5e604d4461e677e
SHA1 0a3b44efca7c966712ecfe1361056503d83537a1
SHA512 59e27cc0a7076c87c79d166d8766e168d9313ff272a522677e8e6566cf11eee3f8e37ee2747a06b0132bab6bba98e3c12a0a03591fbfbad2291979001839ef33
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 03d11c56571a3caaf95e5577919ba362cea91f072579390d91c11ca0b5ba8677
MD5 6b4f7afbb7c91cd8ed2477b1fb270ec8
SHA1 f531f30d1d43410e8f8bd8b19f1a902c77396ec1
SHA512 def8211d7ea726816f88f3e6811a0b54d0ace1507abde6afbf44760f7bedbc2373390698557ceb9461be3742f6e42efa0c48ad126e2e07cfff93b19d042d8046
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 4e307e70cd10ad3350ea308cdb20860f8f04e707ea10836a723849ca282c3ea0
MD5 a00ab65b5c0b8c137d2600f7e22b2485
SHA1 f9e4f24fc4a8b11f754973a6593c2c81c2c4cc97
SHA512 463baf71f98bc2cdb57386a6ab2ec121fc1cea3b6bd763bceb4fdd5e19e828101f937d5032148bcfe503b73feef073a212dc6e01e1482a281d8f545f7d741ae1
MD5 SHA1 SHA512

Submit Download

5C4E791B.TMP

Path C:\Users\Admin\AppData\Local\Temp\5C4E791B.TMP
Size 86B
SHA256 422aff9a0e0fc8b6b4e60f422f67b5cb12753ca5f45fdd3dbbd21f450d093458
MD5 c020c41c3d68aa5ca2a5347de3a1fdbd
SHA1 f8302250061ff23bc70766992f07b1a2e385f89b
SHA512 4414390546bbe9cf505ab0cc3d03615b966398a16cecb52d3d7ed60a34ea923a655b31d614743a937fe0cc0865599c7dce4ea9b6f948c7a7ae42e53f16f2934b
MD5 SHA1 SHA512

Submit Download

memory/220-831-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/220-886-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/772-178-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/864-721-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/864-775-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/888-593-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/888-535-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/964-948-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/1372-1011-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/1372-958-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/1420-415-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/1420-473-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/1680-648-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2040-0-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2040-58-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2120-661-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2120-713-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2192-413-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2252-660-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2296-1004-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2364-596-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2364-544-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2640-79-0x00000000007B0000-0x00000000007F8000-memory.dmp

Download

memory/2640-73-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2640-74-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2640-122-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2640-70-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2640-75-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2640-76-0x00000000007B0000-0x00000000007F8000-memory.dmp

Download

memory/2640-63-0x00000000007B0000-0x00000000007F8000-memory.dmp

Download

memory/2836-355-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2844-418-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2844-364-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2872-14-0x0000000000680000-0x00000000006C8000-memory.dmp

Download

memory/2872-8-0x0000000000680000-0x00000000006C8000-memory.dmp

Download

memory/2872-3-0x0000000000680000-0x00000000006C8000-memory.dmp

Download

memory/2872-13-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2872-17-0x0000000000680000-0x00000000006C8000-memory.dmp

Download

memory/2872-12-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2872-67-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2872-69-0x0000000000680000-0x00000000006C8000-memory.dmp

Download

memory/2872-11-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2880-830-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2880-772-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2884-537-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2884-484-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/2916-892-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/3052-707-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/3096-781-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/3096-834-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/3136-358-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/3136-305-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/3272-22-0x0000000010000000-0x000000001015D000-memory.dmp

Download

memory/3272-48-0x0000000010000000-0x000000001015D000-memory.dmp

Download

memory/3272-21-0x0000000010000000-0x000000001015D000-memory.dmp

Download

memory/3272-19-0x0000000010000000-0x000000001015D000-memory.dmp

Download

memory/3388-246-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/3388-298-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/3508-1063-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/3508-1008-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/3952-295-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4044-233-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4088-120-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4088-55-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4088-57-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4088-59-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4088-53-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4264-952-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/4264-899-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/4296-770-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4296-714-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4416-239-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/4552-49-0x0000000010000000-0x000000001015D000-memory.dmp

Download

memory/4916-424-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/4916-483-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/4972-182-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/4972-129-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/5016-475-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/5016-530-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads