Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 21:44
Static task
static1
Behavioral task
behavioral1
Sample
8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
8c1680d7c247565cb1b7e1f4a565b937
-
SHA1
d37b366345613dd448ec94a290e487f30352d025
-
SHA256
8b973f38daaf5da6ba254a97ffda82d758b0aade4b33cff335286c206e9e5694
-
SHA512
aa0ecddd8a6192ea38c5c8b78fea04888215bd9691480b5ebf8b75a0873e7334b104aa7ab95561c64af4ad3d08eb819037eb9515d2b1b7362ba28eda10713b62
-
SSDEEP
49152:HRNseRIRjmkzgzoQfJN4ksJoQfJN4ksj5:f+RjxkouQ7JouQ79
Malware Config
Signatures
-
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 1688 set thread context of 2276 1688 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 30 PID 2276 set thread context of 1820 2276 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 31 PID 1820 set thread context of 1680 1820 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 32 PID 1680 set thread context of 2184 1680 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 33 PID 2184 set thread context of 2812 2184 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 34 PID 2812 set thread context of 2916 2812 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 35 PID 2916 set thread context of 964 2916 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 36 PID 964 set thread context of 2256 964 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 37 PID 2256 set thread context of 2884 2256 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 38 PID 2884 set thread context of 1724 2884 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 39 PID 1724 set thread context of 1980 1724 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 40 PID 1980 set thread context of 2784 1980 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 41 PID 2784 set thread context of 2956 2784 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 42 PID 2956 set thread context of 904 2956 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 43 PID 904 set thread context of 912 904 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 44 PID 912 set thread context of 2132 912 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 45 PID 2132 set thread context of 2996 2132 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 46 PID 2996 set thread context of 1572 2996 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 47 PID 1572 set thread context of 1116 1572 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 48 PID 1116 set thread context of 2072 1116 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 49 PID 2072 set thread context of 1132 2072 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 50 PID 1132 set thread context of 3040 1132 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 51 PID 3040 set thread context of 1832 3040 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 52 PID 1832 set thread context of 2620 1832 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 53 PID 2620 set thread context of 2924 2620 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 54 PID 2924 set thread context of 704 2924 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 55 PID 704 set thread context of 2636 704 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 56 PID 2636 set thread context of 1936 2636 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 57 PID 1936 set thread context of 484 1936 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 58 PID 484 set thread context of 692 484 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 59 PID 692 set thread context of 608 692 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 60 PID 608 set thread context of 1492 608 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 61 PID 1492 set thread context of 1336 1492 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 62 PID 1336 set thread context of 1328 1336 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 63 PID 1328 set thread context of 2244 1328 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 64 PID 2244 set thread context of 3004 2244 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 65 PID 3004 set thread context of 1664 3004 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 66 PID 1664 set thread context of 2220 1664 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 67 PID 2220 set thread context of 3012 2220 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 68 PID 3012 set thread context of 1956 3012 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 69 PID 1956 set thread context of 2260 1956 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 70 PID 2260 set thread context of 3048 2260 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 71 PID 3048 set thread context of 320 3048 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 72 PID 320 set thread context of 1592 320 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 73 PID 1592 set thread context of 2428 1592 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 74 PID 2428 set thread context of 2168 2428 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 75 PID 2168 set thread context of 1536 2168 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 76 PID 1536 set thread context of 1788 1536 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 77 PID 1788 set thread context of 2876 1788 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 78 PID 2876 set thread context of 1600 2876 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 79 PID 1600 set thread context of 1744 1600 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 80 PID 1744 set thread context of 1136 1744 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 81 PID 1136 set thread context of 3044 1136 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 82 PID 3044 set thread context of 2040 3044 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 83 PID 2040 set thread context of 2056 2040 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 84 PID 2056 set thread context of 2316 2056 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 85 PID 2316 set thread context of 1840 2316 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 86 PID 1840 set thread context of 2820 1840 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 87 PID 2820 set thread context of 2608 2820 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 88 PID 2608 set thread context of 1768 2608 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 89 PID 1768 set thread context of 2904 1768 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 90 PID 2904 set thread context of 3036 2904 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 91 PID 3036 set thread context of 2424 3036 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 92 PID 2424 set thread context of 2224 2424 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 93 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2276 1688 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 30 PID 1688 wrote to memory of 2276 1688 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 30 PID 1688 wrote to memory of 2276 1688 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 30 PID 1688 wrote to memory of 2276 1688 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 30 PID 1688 wrote to memory of 2276 1688 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 30 PID 1688 wrote to memory of 2276 1688 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 30 PID 1688 wrote to memory of 2276 1688 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 30 PID 1688 wrote to memory of 2276 1688 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 30 PID 1688 wrote to memory of 2276 1688 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 30 PID 1688 wrote to memory of 2276 1688 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 30 PID 1688 wrote to memory of 2276 1688 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 30 PID 2276 wrote to memory of 1820 2276 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 31 PID 2276 wrote to memory of 1820 2276 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 31 PID 2276 wrote to memory of 1820 2276 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 31 PID 2276 wrote to memory of 1820 2276 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 31 PID 2276 wrote to memory of 1820 2276 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 31 PID 2276 wrote to memory of 1820 2276 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 31 PID 2276 wrote to memory of 1820 2276 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 31 PID 2276 wrote to memory of 1820 2276 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 31 PID 2276 wrote to memory of 1820 2276 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 31 PID 2276 wrote to memory of 1820 2276 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 31 PID 2276 wrote to memory of 1820 2276 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 31 PID 1820 wrote to memory of 1680 1820 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 32 PID 1820 wrote to memory of 1680 1820 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 32 PID 1820 wrote to memory of 1680 1820 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 32 PID 1820 wrote to memory of 1680 1820 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 32 PID 1820 wrote to memory of 1680 1820 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 32 PID 1820 wrote to memory of 1680 1820 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 32 PID 1820 wrote to memory of 1680 1820 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 32 PID 1820 wrote to memory of 1680 1820 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 32 PID 1820 wrote to memory of 1680 1820 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 32 PID 1820 wrote to memory of 1680 1820 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 32 PID 1820 wrote to memory of 1680 1820 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 32 PID 1680 wrote to memory of 2184 1680 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 33 PID 1680 wrote to memory of 2184 1680 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 33 PID 1680 wrote to memory of 2184 1680 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 33 PID 1680 wrote to memory of 2184 1680 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 33 PID 1680 wrote to memory of 2184 1680 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 33 PID 1680 wrote to memory of 2184 1680 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 33 PID 1680 wrote to memory of 2184 1680 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 33 PID 1680 wrote to memory of 2184 1680 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 33 PID 1680 wrote to memory of 2184 1680 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 33 PID 1680 wrote to memory of 2184 1680 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 33 PID 1680 wrote to memory of 2184 1680 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 33 PID 2184 wrote to memory of 2812 2184 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 34 PID 2184 wrote to memory of 2812 2184 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 34 PID 2184 wrote to memory of 2812 2184 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 34 PID 2184 wrote to memory of 2812 2184 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 34 PID 2184 wrote to memory of 2812 2184 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 34 PID 2184 wrote to memory of 2812 2184 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 34 PID 2184 wrote to memory of 2812 2184 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 34 PID 2184 wrote to memory of 2812 2184 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 34 PID 2184 wrote to memory of 2812 2184 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 34 PID 2184 wrote to memory of 2812 2184 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 34 PID 2184 wrote to memory of 2812 2184 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 34 PID 2812 wrote to memory of 2916 2812 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 35 PID 2812 wrote to memory of 2916 2812 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 35 PID 2812 wrote to memory of 2916 2812 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 35 PID 2812 wrote to memory of 2916 2812 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 35 PID 2812 wrote to memory of 2916 2812 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 35 PID 2812 wrote to memory of 2916 2812 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 35 PID 2812 wrote to memory of 2916 2812 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 35 PID 2812 wrote to memory of 2916 2812 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 35 PID 2812 wrote to memory of 2916 2812 8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe5⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe7⤵
- Suspicious use of SetThreadContext
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe8⤵
- Suspicious use of SetThreadContext
PID:964 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe9⤵
- Suspicious use of SetThreadContext
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe10⤵
- Suspicious use of SetThreadContext
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe11⤵
- Suspicious use of SetThreadContext
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe12⤵
- Suspicious use of SetThreadContext
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe13⤵
- Suspicious use of SetThreadContext
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe14⤵
- Suspicious use of SetThreadContext
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe15⤵
- Suspicious use of SetThreadContext
PID:904 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe16⤵
- Suspicious use of SetThreadContext
PID:912 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe17⤵
- Suspicious use of SetThreadContext
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe18⤵
- Suspicious use of SetThreadContext
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe19⤵
- Suspicious use of SetThreadContext
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe20⤵
- Suspicious use of SetThreadContext
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe21⤵
- Suspicious use of SetThreadContext
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe22⤵
- Suspicious use of SetThreadContext
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe23⤵
- Suspicious use of SetThreadContext
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe24⤵
- Suspicious use of SetThreadContext
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe25⤵
- Suspicious use of SetThreadContext
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe26⤵
- Suspicious use of SetThreadContext
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe27⤵
- Suspicious use of SetThreadContext
PID:704 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe28⤵
- Suspicious use of SetThreadContext
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe29⤵
- Suspicious use of SetThreadContext
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe30⤵
- Suspicious use of SetThreadContext
PID:484 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe31⤵
- Suspicious use of SetThreadContext
PID:692 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe32⤵
- Suspicious use of SetThreadContext
PID:608 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe33⤵
- Suspicious use of SetThreadContext
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe34⤵
- Suspicious use of SetThreadContext
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe35⤵
- Suspicious use of SetThreadContext
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe36⤵
- Suspicious use of SetThreadContext
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe37⤵
- Suspicious use of SetThreadContext
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe38⤵
- Suspicious use of SetThreadContext
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe39⤵
- Suspicious use of SetThreadContext
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe40⤵
- Suspicious use of SetThreadContext
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe41⤵
- Suspicious use of SetThreadContext
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe42⤵
- Suspicious use of SetThreadContext
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe43⤵
- Suspicious use of SetThreadContext
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe44⤵
- Suspicious use of SetThreadContext
PID:320 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe45⤵
- Suspicious use of SetThreadContext
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe46⤵
- Suspicious use of SetThreadContext
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe47⤵
- Suspicious use of SetThreadContext
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe48⤵
- Suspicious use of SetThreadContext
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe49⤵
- Suspicious use of SetThreadContext
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe50⤵
- Suspicious use of SetThreadContext
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe51⤵
- Suspicious use of SetThreadContext
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe52⤵
- Suspicious use of SetThreadContext
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe53⤵
- Suspicious use of SetThreadContext
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe54⤵
- Suspicious use of SetThreadContext
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe55⤵
- Suspicious use of SetThreadContext
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe56⤵
- Suspicious use of SetThreadContext
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe57⤵
- Suspicious use of SetThreadContext
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe58⤵
- Suspicious use of SetThreadContext
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe59⤵
- Suspicious use of SetThreadContext
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe60⤵
- Suspicious use of SetThreadContext
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe61⤵
- Suspicious use of SetThreadContext
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe62⤵
- Suspicious use of SetThreadContext
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe63⤵
- Suspicious use of SetThreadContext
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe64⤵
- Suspicious use of SetThreadContext
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe65⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe66⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe67⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe68⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe69⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe70⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe71⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe72⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe73⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe74⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe75⤵
- System Location Discovery: System Language Discovery
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe76⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe77⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe78⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe79⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe80⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe81⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe82⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe83⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe84⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe85⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe86⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe87⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe88⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe89⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe90⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe91⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe92⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe93⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe94⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe95⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe96⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe97⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe98⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe99⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe100⤵
- System Location Discovery: System Language Discovery
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe101⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe102⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe103⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe104⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe105⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe106⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe107⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe108⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe109⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe110⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe111⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe112⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe113⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe114⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe115⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe116⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe117⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe118⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe119⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe120⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe121⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8c1680d7c247565cb1b7e1f4a565b937_JaffaCakes118.exe122⤵PID:796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-