Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2024, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe
-
Size
32KB
-
MD5
95c7bdf530badcc93d41b0628d6a28e8
-
SHA1
cae5e226b1725bedd838e55b982123b12f58ceb9
-
SHA256
de5c83a3a4dee59c6bea4b9ffd022026d06f5496a6f284366d47c00664a50c34
-
SHA512
6c26492d3414bce1eb72c2fc3ee23c001f32bbbf16ed70d8e8edffdf157c8a03912c0b8ccb712b3657a215c0f21891cf167264f47e503ef0e3b82b22e1b326c7
-
SSDEEP
384:OPOQrzHf9bPtA2t8+H2YTnoF5qIM8c1wzBw66Fqqkmq:OPOI/Z2YTncql8YwzBw660qkmq
Malware Config
Signatures
-
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 2684 set thread context of 2396 2684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 84 PID 2396 set thread context of 2496 2396 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 85 PID 2496 set thread context of 3224 2496 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 86 PID 3224 set thread context of 2616 3224 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 87 PID 2616 set thread context of 1684 2616 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 88 PID 1684 set thread context of 3972 1684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 89 PID 3972 set thread context of 2052 3972 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 90 PID 2052 set thread context of 1724 2052 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 91 PID 1724 set thread context of 2392 1724 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 92 PID 2392 set thread context of 224 2392 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 93 PID 224 set thread context of 1280 224 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 94 PID 1280 set thread context of 4180 1280 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 95 PID 4180 set thread context of 512 4180 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 96 PID 512 set thread context of 4364 512 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 97 PID 4364 set thread context of 3864 4364 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 98 PID 3864 set thread context of 4828 3864 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 99 PID 4828 set thread context of 624 4828 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 100 PID 624 set thread context of 4192 624 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 101 PID 4192 set thread context of 4788 4192 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 102 PID 4788 set thread context of 1408 4788 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 103 PID 1408 set thread context of 1336 1408 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 104 PID 1336 set thread context of 4040 1336 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 105 PID 4040 set thread context of 4988 4040 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 106 PID 4988 set thread context of 1192 4988 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 107 PID 1192 set thread context of 4208 1192 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 109 PID 4208 set thread context of 1284 4208 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 110 PID 1284 set thread context of 2964 1284 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 111 PID 2964 set thread context of 3484 2964 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 112 PID 3484 set thread context of 4296 3484 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 113 PID 4296 set thread context of 840 4296 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 114 PID 840 set thread context of 3636 840 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 115 PID 3636 set thread context of 1132 3636 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 116 PID 1132 set thread context of 3412 1132 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 117 PID 3412 set thread context of 760 3412 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 118 PID 760 set thread context of 4388 760 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 119 PID 4388 set thread context of 4372 4388 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 120 PID 4372 set thread context of 5076 4372 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 121 PID 5076 set thread context of 216 5076 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 122 PID 216 set thread context of 4800 216 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 123 PID 4800 set thread context of 1620 4800 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 124 PID 1620 set thread context of 1264 1620 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 125 PID 1264 set thread context of 2036 1264 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 126 PID 2036 set thread context of 1964 2036 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 127 PID 1964 set thread context of 4232 1964 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 128 PID 4232 set thread context of 4764 4232 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 129 PID 4764 set thread context of 4220 4764 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 130 PID 4220 set thread context of 4888 4220 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 131 PID 4888 set thread context of 1276 4888 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 132 PID 1276 set thread context of 412 1276 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 133 PID 412 set thread context of 3328 412 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 134 PID 3328 set thread context of 2092 3328 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 135 PID 2092 set thread context of 4564 2092 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 136 PID 4564 set thread context of 1636 4564 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 137 PID 1636 set thread context of 4060 1636 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 138 PID 4060 set thread context of 1744 4060 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 139 PID 1744 set thread context of 3584 1744 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 140 PID 3584 set thread context of 3316 3584 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 141 PID 3316 set thread context of 3664 3316 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 142 PID 3664 set thread context of 1244 3664 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 143 PID 1244 set thread context of 2028 1244 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 144 PID 2028 set thread context of 4744 2028 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 145 PID 4744 set thread context of 4576 4744 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 146 PID 4576 set thread context of 4132 4576 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 147 PID 4132 set thread context of 4664 4132 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 148 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 2396 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 2496 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 3224 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 2616 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 1684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 3972 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 2052 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 1724 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 2392 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 224 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 1280 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4180 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 512 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4364 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 3864 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4828 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 624 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4192 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4788 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 1408 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 1336 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4040 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4988 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 1192 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4208 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 1284 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 2964 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 3484 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4296 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 840 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 3636 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 1132 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 3412 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 760 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4388 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4372 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 5076 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 216 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4800 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 1620 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 1264 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 2036 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 1964 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4232 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4764 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4220 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4888 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 1276 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 412 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 3328 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 2092 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4564 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 1636 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4060 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 1744 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 3584 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 3316 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 3664 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 1244 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 2028 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4744 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4576 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 4132 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2396 2684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 84 PID 2684 wrote to memory of 2396 2684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 84 PID 2684 wrote to memory of 2396 2684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 84 PID 2684 wrote to memory of 2396 2684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 84 PID 2684 wrote to memory of 2396 2684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 84 PID 2684 wrote to memory of 2396 2684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 84 PID 2684 wrote to memory of 2396 2684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 84 PID 2684 wrote to memory of 2396 2684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 84 PID 2396 wrote to memory of 2496 2396 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 85 PID 2396 wrote to memory of 2496 2396 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 85 PID 2396 wrote to memory of 2496 2396 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 85 PID 2396 wrote to memory of 2496 2396 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 85 PID 2396 wrote to memory of 2496 2396 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 85 PID 2396 wrote to memory of 2496 2396 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 85 PID 2396 wrote to memory of 2496 2396 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 85 PID 2396 wrote to memory of 2496 2396 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 85 PID 2496 wrote to memory of 3224 2496 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 86 PID 2496 wrote to memory of 3224 2496 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 86 PID 2496 wrote to memory of 3224 2496 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 86 PID 2496 wrote to memory of 3224 2496 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 86 PID 2496 wrote to memory of 3224 2496 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 86 PID 2496 wrote to memory of 3224 2496 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 86 PID 2496 wrote to memory of 3224 2496 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 86 PID 2496 wrote to memory of 3224 2496 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 86 PID 3224 wrote to memory of 2616 3224 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 87 PID 3224 wrote to memory of 2616 3224 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 87 PID 3224 wrote to memory of 2616 3224 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 87 PID 3224 wrote to memory of 2616 3224 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 87 PID 3224 wrote to memory of 2616 3224 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 87 PID 3224 wrote to memory of 2616 3224 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 87 PID 3224 wrote to memory of 2616 3224 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 87 PID 3224 wrote to memory of 2616 3224 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 87 PID 2616 wrote to memory of 1684 2616 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 88 PID 2616 wrote to memory of 1684 2616 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 88 PID 2616 wrote to memory of 1684 2616 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 88 PID 2616 wrote to memory of 1684 2616 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 88 PID 2616 wrote to memory of 1684 2616 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 88 PID 2616 wrote to memory of 1684 2616 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 88 PID 2616 wrote to memory of 1684 2616 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 88 PID 2616 wrote to memory of 1684 2616 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 88 PID 1684 wrote to memory of 3972 1684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 89 PID 1684 wrote to memory of 3972 1684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 89 PID 1684 wrote to memory of 3972 1684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 89 PID 1684 wrote to memory of 3972 1684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 89 PID 1684 wrote to memory of 3972 1684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 89 PID 1684 wrote to memory of 3972 1684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 89 PID 1684 wrote to memory of 3972 1684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 89 PID 1684 wrote to memory of 3972 1684 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 89 PID 3972 wrote to memory of 2052 3972 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 90 PID 3972 wrote to memory of 2052 3972 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 90 PID 3972 wrote to memory of 2052 3972 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 90 PID 3972 wrote to memory of 2052 3972 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 90 PID 3972 wrote to memory of 2052 3972 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 90 PID 3972 wrote to memory of 2052 3972 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 90 PID 3972 wrote to memory of 2052 3972 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 90 PID 3972 wrote to memory of 2052 3972 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 90 PID 2052 wrote to memory of 1724 2052 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 91 PID 2052 wrote to memory of 1724 2052 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 91 PID 2052 wrote to memory of 1724 2052 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 91 PID 2052 wrote to memory of 1724 2052 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 91 PID 2052 wrote to memory of 1724 2052 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 91 PID 2052 wrote to memory of 1724 2052 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 91 PID 2052 wrote to memory of 1724 2052 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 91 PID 2052 wrote to memory of 1724 2052 95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe5⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe8⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe9⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe10⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe11⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:224 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe12⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe13⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe14⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:512 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe15⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe16⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe17⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe18⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:624 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe19⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe20⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe21⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe22⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe23⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe24⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe25⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe26⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe27⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe28⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe29⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe30⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe31⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:840 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe32⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe33⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe34⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe35⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:760 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe36⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe37⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe38⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe39⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:216 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe40⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe41⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe42⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe43⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe44⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe45⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe46⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe47⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe48⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe49⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe50⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:412 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe51⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe52⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe53⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe54⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe55⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe56⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe57⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe58⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe59⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe60⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe61⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe62⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe63⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe64⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe65⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe66⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe67⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe68⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe69⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe70⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe71⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe72⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe73⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe74⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe75⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe76⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe77⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe78⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe79⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe80⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe81⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe82⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe83⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe84⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe85⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe86⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe87⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe88⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe89⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe90⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe91⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe92⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe93⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe94⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe95⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe96⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe97⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe98⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe99⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe100⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe101⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe102⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe103⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe104⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe105⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe106⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe107⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe108⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe109⤵
- System Location Discovery: System Language Discovery
PID:664 -
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe110⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe111⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe112⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe113⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe114⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe115⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe116⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe117⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe118⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe119⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe120⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe121⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\95c7bdf530badcc93d41b0628d6a28e8_JaffaCakes118.exe122⤵PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-