Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 18:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe
Resource
win7-20240708-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe
Resource
win10v2004-20240709-en
3 signatures
150 seconds
General
-
Target
4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
4ae7a6ed251b2d20254d4d6a6b259e83
-
SHA1
bebafd50068a069a93e229a0ed1975d650db3f80
-
SHA256
7fcad7a340be86836f887ff63a1f9a7f76b04acec66a2bae09792fb46eecb579
-
SHA512
f2ff0a8cc69b6c2ca80614af12e7ea4e80f6a11aa6f1e07f9b44d5c038d67198306d8f98645f15153fda00361e821d46b24de577e9d00a151010cc42e193d70e
-
SSDEEP
24576:xHoIjIbgyLC495467oV2aT4PTBENMvPZ4UMmZRVUf1QIppVqPyudcQgU:xv8bdLp54U9PSKDgf1Npu2Q
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 1480 set thread context of 1328 1480 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 85 PID 1328 set thread context of 1512 1328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 87 PID 1512 set thread context of 4108 1512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 88 PID 4108 set thread context of 4236 4108 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 89 PID 4236 set thread context of 3168 4236 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 90 PID 3168 set thread context of 1140 3168 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 91 PID 1140 set thread context of 2256 1140 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 92 PID 2256 set thread context of 3152 2256 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 93 PID 3152 set thread context of 1308 3152 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 94 PID 1308 set thread context of 3888 1308 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 95 PID 3888 set thread context of 4164 3888 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 96 PID 4164 set thread context of 4224 4164 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 97 PID 4224 set thread context of 5004 4224 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 98 PID 5004 set thread context of 760 5004 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 99 PID 760 set thread context of 1860 760 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 100 PID 1860 set thread context of 4772 1860 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 101 PID 4772 set thread context of 3032 4772 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 102 PID 3032 set thread context of 3728 3032 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 103 PID 3728 set thread context of 3948 3728 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 104 PID 3948 set thread context of 2600 3948 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 105 PID 2600 set thread context of 4940 2600 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 106 PID 4940 set thread context of 3528 4940 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 107 PID 3528 set thread context of 3328 3528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 108 PID 3328 set thread context of 4852 3328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 109 PID 4852 set thread context of 1164 4852 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 110 PID 1164 set thread context of 4484 1164 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 111 PID 4484 set thread context of 4756 4484 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 112 PID 4756 set thread context of 3456 4756 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 113 PID 3456 set thread context of 4112 3456 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 114 PID 4112 set thread context of 396 4112 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 115 PID 396 set thread context of 4240 396 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 116 PID 4240 set thread context of 3384 4240 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 117 PID 3384 set thread context of 3920 3384 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 118 PID 3920 set thread context of 3012 3920 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 119 PID 3012 set thread context of 3760 3012 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 120 PID 3760 set thread context of 1880 3760 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 121 PID 1880 set thread context of 3592 1880 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 122 PID 3592 set thread context of 3940 3592 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 123 PID 3940 set thread context of 4288 3940 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 124 PID 4288 set thread context of 824 4288 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 125 PID 824 set thread context of 3648 824 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 126 PID 3648 set thread context of 2800 3648 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 127 PID 2800 set thread context of 448 2800 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 128 PID 448 set thread context of 1624 448 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 129 PID 1624 set thread context of 1748 1624 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 130 PID 1748 set thread context of 512 1748 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 131 PID 512 set thread context of 1928 512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 132 PID 1928 set thread context of 2264 1928 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 133 PID 2264 set thread context of 4688 2264 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 134 PID 4688 set thread context of 996 4688 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 135 PID 996 set thread context of 724 996 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 136 PID 724 set thread context of 4884 724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 137 PID 4884 set thread context of 2036 4884 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 138 PID 2036 set thread context of 2360 2036 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 139 PID 2360 set thread context of 2864 2360 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 140 PID 2864 set thread context of 2348 2864 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 141 PID 2348 set thread context of 2032 2348 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 142 PID 2032 set thread context of 3436 2032 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 143 PID 3436 set thread context of 2516 3436 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 144 PID 2516 set thread context of 3552 2516 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 145 PID 3552 set thread context of 2504 3552 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 146 PID 2504 set thread context of 752 2504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 147 PID 752 set thread context of 2092 752 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 148 PID 2092 set thread context of 4300 2092 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 149 -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1480 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 4108 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 4236 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3168 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1140 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2256 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3152 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1308 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3888 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 4164 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 4224 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 5004 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 760 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1860 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 4772 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3032 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3728 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3948 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2600 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 4940 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3528 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 4852 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1164 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 4484 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 4756 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3456 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 4112 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 396 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 4240 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3384 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3920 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3012 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3760 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1880 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3592 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3940 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 4288 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 824 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3648 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2800 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 448 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1624 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1748 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 1928 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2264 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 4688 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 996 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 724 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 4884 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2036 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2360 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2864 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2348 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2032 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3436 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2516 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 3552 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2504 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 752 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 2092 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1480 wrote to memory of 1328 1480 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 85 PID 1480 wrote to memory of 1328 1480 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 85 PID 1480 wrote to memory of 1328 1480 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 85 PID 1480 wrote to memory of 1328 1480 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 85 PID 1480 wrote to memory of 1328 1480 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 85 PID 1480 wrote to memory of 1328 1480 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 85 PID 1480 wrote to memory of 1328 1480 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 85 PID 1480 wrote to memory of 1328 1480 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 85 PID 1480 wrote to memory of 1328 1480 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 85 PID 1480 wrote to memory of 1328 1480 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 85 PID 1480 wrote to memory of 1328 1480 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 85 PID 1480 wrote to memory of 1328 1480 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 85 PID 1480 wrote to memory of 1328 1480 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 85 PID 1328 wrote to memory of 1512 1328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 87 PID 1328 wrote to memory of 1512 1328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 87 PID 1328 wrote to memory of 1512 1328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 87 PID 1328 wrote to memory of 1512 1328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 87 PID 1328 wrote to memory of 1512 1328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 87 PID 1328 wrote to memory of 1512 1328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 87 PID 1328 wrote to memory of 1512 1328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 87 PID 1328 wrote to memory of 1512 1328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 87 PID 1328 wrote to memory of 1512 1328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 87 PID 1328 wrote to memory of 1512 1328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 87 PID 1328 wrote to memory of 1512 1328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 87 PID 1328 wrote to memory of 1512 1328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 87 PID 1328 wrote to memory of 1512 1328 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 87 PID 1512 wrote to memory of 4108 1512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 88 PID 1512 wrote to memory of 4108 1512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 88 PID 1512 wrote to memory of 4108 1512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 88 PID 1512 wrote to memory of 4108 1512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 88 PID 1512 wrote to memory of 4108 1512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 88 PID 1512 wrote to memory of 4108 1512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 88 PID 1512 wrote to memory of 4108 1512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 88 PID 1512 wrote to memory of 4108 1512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 88 PID 1512 wrote to memory of 4108 1512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 88 PID 1512 wrote to memory of 4108 1512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 88 PID 1512 wrote to memory of 4108 1512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 88 PID 1512 wrote to memory of 4108 1512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 88 PID 1512 wrote to memory of 4108 1512 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 88 PID 4108 wrote to memory of 4236 4108 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 89 PID 4108 wrote to memory of 4236 4108 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 89 PID 4108 wrote to memory of 4236 4108 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 89 PID 4108 wrote to memory of 4236 4108 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 89 PID 4108 wrote to memory of 4236 4108 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 89 PID 4108 wrote to memory of 4236 4108 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 89 PID 4108 wrote to memory of 4236 4108 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 89 PID 4108 wrote to memory of 4236 4108 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 89 PID 4108 wrote to memory of 4236 4108 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 89 PID 4108 wrote to memory of 4236 4108 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 89 PID 4108 wrote to memory of 4236 4108 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 89 PID 4108 wrote to memory of 4236 4108 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 89 PID 4108 wrote to memory of 4236 4108 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 89 PID 4236 wrote to memory of 3168 4236 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 90 PID 4236 wrote to memory of 3168 4236 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 90 PID 4236 wrote to memory of 3168 4236 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 90 PID 4236 wrote to memory of 3168 4236 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 90 PID 4236 wrote to memory of 3168 4236 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 90 PID 4236 wrote to memory of 3168 4236 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 90 PID 4236 wrote to memory of 3168 4236 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 90 PID 4236 wrote to memory of 3168 4236 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 90 PID 4236 wrote to memory of 3168 4236 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 90 PID 4236 wrote to memory of 3168 4236 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 90 PID 4236 wrote to memory of 3168 4236 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 90 PID 4236 wrote to memory of 3168 4236 4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"8⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"9⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"10⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"12⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"13⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"14⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"15⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:760 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"16⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"17⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"18⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"19⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"20⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"21⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"22⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"23⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"24⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"25⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"26⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"27⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"28⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"29⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"30⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"31⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:396 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"32⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"33⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"34⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"35⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"36⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"37⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"38⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"39⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"40⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"41⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:824 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"42⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"43⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"44⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:448 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"45⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"46⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"47⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:512 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"48⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"49⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"50⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"51⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:996 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"52⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:724 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"53⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"54⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"55⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"56⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"57⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"58⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"59⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"60⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"61⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"62⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"63⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:752 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"64⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"65⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"66⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"67⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"68⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"69⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"70⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"71⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"72⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"73⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"74⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"75⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"76⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"77⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"78⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"79⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"80⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"81⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"82⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"83⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"84⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"85⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"86⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"87⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"88⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"89⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"90⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"91⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"92⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"93⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"94⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"95⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"96⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"97⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"98⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"99⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"100⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"101⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"102⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"103⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"104⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"105⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"106⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"107⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"108⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"109⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"110⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"111⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"112⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"113⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"114⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"115⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"116⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"117⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"118⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"119⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"120⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"121⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae7a6ed251b2d20254d4d6a6b259e83_JaffaCakes118.exe"122⤵PID:2072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-