Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 18:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe
Resource
win7-20240708-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe
Resource
win10v2004-20240709-en
3 signatures
150 seconds
General
-
Target
4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
4ae7a6ed251b2d20254d4d6a6b259e83
-
SHA1
bebafd50068a069a93e229a0ed1975d650db3f80
-
SHA256
7fcad7a340be86836f887ff63a1f9a7f76b04acec66a2bae09792fb46eecb579
-
SHA512
f2ff0a8cc69b6c2ca80614af12e7ea4e80f6a11aa6f1e07f9b44d5c038d67198306d8f98645f15153fda00361e821d46b24de577e9d00a151010cc42e193d70e
-
SSDEEP
24576:xHoIjIbgyLC495467oV2aT4PTBENMvPZ4UMmZRVUf1QIppVqPyudcQgU:xv8bdLp54U9PSKDgf1Npu2Q
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 1176 set thread context of 1504 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 31 PID 1504 set thread context of 1724 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 32 PID 1724 set thread context of 2528 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 33 PID 2528 set thread context of 2540 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 34 PID 2540 set thread context of 1348 2540 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 35 PID 1348 set thread context of 304 1348 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 36 PID 304 set thread context of 2900 304 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 37 PID 2900 set thread context of 2160 2900 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 38 PID 2160 set thread context of 2120 2160 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 39 PID 2120 set thread context of 1972 2120 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 40 PID 1972 set thread context of 392 1972 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 41 PID 392 set thread context of 2268 392 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 42 PID 2268 set thread context of 1628 2268 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 43 PID 1628 set thread context of 1848 1628 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 44 PID 1848 set thread context of 2728 1848 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 45 PID 2728 set thread context of 2708 2728 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 46 PID 2708 set thread context of 2644 2708 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 47 PID 2644 set thread context of 2368 2644 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 48 PID 2368 set thread context of 1960 2368 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 49 PID 1960 set thread context of 2392 1960 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 50 PID 2392 set thread context of 836 2392 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 51 PID 836 set thread context of 1924 836 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 52 PID 1924 set thread context of 1224 1924 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 53 PID 1224 set thread context of 2436 1224 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 54 PID 2436 set thread context of 2460 2436 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 55 PID 2460 set thread context of 2096 2460 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 56 PID 2096 set thread context of 2052 2096 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 57 PID 2052 set thread context of 2740 2052 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 58 PID 2740 set thread context of 2692 2740 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 59 PID 2692 set thread context of 2424 2692 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 60 PID 2424 set thread context of 2508 2424 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 61 PID 2508 set thread context of 2620 2508 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 62 PID 2620 set thread context of 2560 2620 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 63 PID 2560 set thread context of 3044 2560 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 64 PID 3044 set thread context of 1584 3044 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 65 PID 1584 set thread context of 988 1584 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 66 PID 988 set thread context of 1636 988 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 67 PID 1636 set thread context of 1656 1636 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 68 PID 1656 set thread context of 1892 1656 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 69 PID 1892 set thread context of 2724 1892 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 70 PID 2724 set thread context of 2580 2724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 71 PID 2580 set thread context of 976 2580 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 72 PID 976 set thread context of 1952 976 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 73 PID 1952 set thread context of 1340 1952 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 74 PID 1340 set thread context of 2152 1340 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 75 PID 2152 set thread context of 2888 2152 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 76 PID 2888 set thread context of 2116 2888 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 77 PID 2116 set thread context of 1200 2116 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 78 PID 1200 set thread context of 1904 1200 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 79 PID 1904 set thread context of 2980 1904 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 80 PID 2980 set thread context of 2664 2980 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 81 PID 2664 set thread context of 2912 2664 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 82 PID 2912 set thread context of 2660 2912 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 83 PID 2660 set thread context of 3036 2660 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 84 PID 3036 set thread context of 1824 3036 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 85 PID 1824 set thread context of 2016 1824 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 86 PID 2016 set thread context of 2412 2016 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 87 PID 2412 set thread context of 2940 2412 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 88 PID 2940 set thread context of 340 2940 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 89 PID 340 set thread context of 552 340 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 90 PID 552 set thread context of 1396 552 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 91 PID 1396 set thread context of 2068 1396 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 92 PID 2068 set thread context of 2192 2068 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 93 PID 2192 set thread context of 2616 2192 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 94 -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2540 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1348 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 304 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2900 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2160 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2120 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1972 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 392 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2268 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1628 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1848 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2728 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2708 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2644 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2368 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1960 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2392 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 836 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1924 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1224 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2436 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2460 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2096 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2052 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2740 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2692 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2424 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2508 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2620 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2560 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3044 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1584 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 988 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1636 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1656 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1892 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2580 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 976 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1952 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1340 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2152 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2888 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2116 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1200 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1904 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2980 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2664 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2912 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2660 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3036 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1824 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2016 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2412 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2940 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 340 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 552 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1396 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2068 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2192 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1176 wrote to memory of 1504 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 31 PID 1176 wrote to memory of 1504 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 31 PID 1176 wrote to memory of 1504 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 31 PID 1176 wrote to memory of 1504 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 31 PID 1176 wrote to memory of 1504 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 31 PID 1176 wrote to memory of 1504 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 31 PID 1176 wrote to memory of 1504 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 31 PID 1176 wrote to memory of 1504 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 31 PID 1176 wrote to memory of 1504 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 31 PID 1176 wrote to memory of 1504 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 31 PID 1176 wrote to memory of 1504 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 31 PID 1176 wrote to memory of 1504 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 31 PID 1176 wrote to memory of 1504 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 31 PID 1176 wrote to memory of 1504 1176 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 31 PID 1504 wrote to memory of 1724 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 32 PID 1504 wrote to memory of 1724 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 32 PID 1504 wrote to memory of 1724 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 32 PID 1504 wrote to memory of 1724 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 32 PID 1504 wrote to memory of 1724 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 32 PID 1504 wrote to memory of 1724 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 32 PID 1504 wrote to memory of 1724 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 32 PID 1504 wrote to memory of 1724 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 32 PID 1504 wrote to memory of 1724 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 32 PID 1504 wrote to memory of 1724 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 32 PID 1504 wrote to memory of 1724 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 32 PID 1504 wrote to memory of 1724 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 32 PID 1504 wrote to memory of 1724 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 32 PID 1504 wrote to memory of 1724 1504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 32 PID 1724 wrote to memory of 2528 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 33 PID 1724 wrote to memory of 2528 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 33 PID 1724 wrote to memory of 2528 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 33 PID 1724 wrote to memory of 2528 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 33 PID 1724 wrote to memory of 2528 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 33 PID 1724 wrote to memory of 2528 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 33 PID 1724 wrote to memory of 2528 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 33 PID 1724 wrote to memory of 2528 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 33 PID 1724 wrote to memory of 2528 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 33 PID 1724 wrote to memory of 2528 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 33 PID 1724 wrote to memory of 2528 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 33 PID 1724 wrote to memory of 2528 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 33 PID 1724 wrote to memory of 2528 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 33 PID 1724 wrote to memory of 2528 1724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2540 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 34 PID 2528 wrote to memory of 2540 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 34 PID 2528 wrote to memory of 2540 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 34 PID 2528 wrote to memory of 2540 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 34 PID 2528 wrote to memory of 2540 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 34 PID 2528 wrote to memory of 2540 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 34 PID 2528 wrote to memory of 2540 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 34 PID 2528 wrote to memory of 2540 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 34 PID 2528 wrote to memory of 2540 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 34 PID 2528 wrote to memory of 2540 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 34 PID 2528 wrote to memory of 2540 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 34 PID 2528 wrote to memory of 2540 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 34 PID 2528 wrote to memory of 2540 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 34 PID 2528 wrote to memory of 2540 2528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 34 PID 2540 wrote to memory of 1348 2540 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 35 PID 2540 wrote to memory of 1348 2540 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 35 PID 2540 wrote to memory of 1348 2540 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 35 PID 2540 wrote to memory of 1348 2540 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 35 PID 2540 wrote to memory of 1348 2540 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 35 PID 2540 wrote to memory of 1348 2540 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 35 PID 2540 wrote to memory of 1348 2540 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 35 PID 2540 wrote to memory of 1348 2540 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:304 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"8⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"9⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"10⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"12⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:392 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"13⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"14⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"15⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"16⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"17⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"18⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"19⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"20⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"21⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"22⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:836 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"23⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"24⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"25⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"26⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"27⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"28⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"29⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"30⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"31⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"32⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"33⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"34⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"35⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"36⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"37⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:988 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"38⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"39⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"40⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"41⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"42⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"43⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:976 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"44⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"45⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"46⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"47⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"48⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"49⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"50⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"51⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"52⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"53⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"54⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"55⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"56⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"57⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"58⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"59⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"60⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:340 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"61⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:552 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"62⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"63⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"64⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"65⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"66⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"67⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"68⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"69⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"70⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"71⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"72⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"73⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"74⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"75⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"76⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"77⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"78⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"79⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"80⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"81⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"82⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"83⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"84⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"85⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"86⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"87⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"88⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"89⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"90⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"91⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"92⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"93⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"94⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"95⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"96⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"97⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"98⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"99⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"100⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"101⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"102⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"103⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"104⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"105⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"106⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"107⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"108⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"109⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"110⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"111⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"112⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"113⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"114⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"115⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"116⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"117⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"118⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"119⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"120⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"121⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"122⤵PID:1956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-