Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 16:08
Static task
static1
Behavioral task
behavioral1
Sample
abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe
-
Size
32KB
-
MD5
abad1497b4cf0ea1ab2b3d2abce5a001
-
SHA1
13d7d4e54ed7e50912ad75983013de7e3df11fb1
-
SHA256
a2ad346008a793ab2b6ff0d75c31f77e4f27aaa446a9696daa1a2bd0699efde4
-
SHA512
1f546f406a164adabb998375cd376dcd684d42a8309211292a1bd534e2aa3e53489a941d23821b2368f2f5fbf989901446916efc5bc6f23c3acda44e1c05ea55
-
SSDEEP
768:GeyKg4WG0HbcaDoGX8SWEjY0opDss56hb3O2BtKqr:fyQF8bceLdo2suOKlr
Malware Config
Signatures
-
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 1580 set thread context of 2240 1580 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 83 PID 2240 set thread context of 4708 2240 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 84 PID 4708 set thread context of 1976 4708 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 85 PID 1976 set thread context of 452 1976 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 86 PID 452 set thread context of 2504 452 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 87 PID 2504 set thread context of 2264 2504 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 88 PID 2264 set thread context of 3948 2264 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 89 PID 3948 set thread context of 5116 3948 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 90 PID 5116 set thread context of 1988 5116 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 91 PID 1988 set thread context of 4304 1988 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 92 PID 4304 set thread context of 3244 4304 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 93 PID 3244 set thread context of 1920 3244 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 94 PID 1920 set thread context of 2064 1920 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 95 PID 2064 set thread context of 1656 2064 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 96 PID 1656 set thread context of 4872 1656 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 97 PID 4872 set thread context of 2524 4872 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 98 PID 2524 set thread context of 2528 2524 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 99 PID 2528 set thread context of 3264 2528 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 100 PID 3264 set thread context of 2296 3264 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 101 PID 2296 set thread context of 3936 2296 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 102 PID 3936 set thread context of 4792 3936 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 103 PID 4792 set thread context of 1556 4792 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 104 PID 1556 set thread context of 2216 1556 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 105 PID 2216 set thread context of 3816 2216 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 106 PID 3816 set thread context of 3952 3816 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 107 PID 3952 set thread context of 3448 3952 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 108 PID 3448 set thread context of 208 3448 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 109 PID 208 set thread context of 392 208 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 110 PID 392 set thread context of 656 392 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 111 PID 656 set thread context of 2304 656 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 112 PID 2304 set thread context of 1396 2304 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 113 PID 1396 set thread context of 2536 1396 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 114 PID 2536 set thread context of 456 2536 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 116 PID 456 set thread context of 2088 456 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 117 PID 2088 set thread context of 2720 2088 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 118 PID 2720 set thread context of 4832 2720 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 119 PID 4832 set thread context of 2428 4832 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 121 PID 2428 set thread context of 1952 2428 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 122 PID 1952 set thread context of 3856 1952 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 123 PID 3856 set thread context of 4804 3856 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 124 PID 4804 set thread context of 440 4804 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 125 PID 440 set thread context of 3160 440 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 188 PID 3160 set thread context of 2928 3160 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 189 PID 2928 set thread context of 3960 2928 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 128 PID 3960 set thread context of 1340 3960 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 129 PID 1340 set thread context of 1708 1340 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 130 PID 1708 set thread context of 2044 1708 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 195 PID 2044 set thread context of 4228 2044 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 196 PID 4228 set thread context of 4652 4228 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 134 PID 4652 set thread context of 1752 4652 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 135 PID 1752 set thread context of 3976 1752 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 136 PID 3976 set thread context of 1284 3976 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 137 PID 1284 set thread context of 924 1284 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 138 PID 924 set thread context of 1060 924 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 139 PID 1060 set thread context of 1660 1060 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 140 PID 1660 set thread context of 2308 1660 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 141 PID 2308 set thread context of 4788 2308 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 142 PID 4788 set thread context of 3400 4788 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 143 PID 3400 set thread context of 2616 3400 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 144 PID 2616 set thread context of 2192 2616 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 145 PID 2192 set thread context of 2172 2192 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 146 PID 4336 set thread context of 2360 4336 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 148 PID 2360 set thread context of 4376 2360 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 149 PID 4376 set thread context of 1408 4376 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 150 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1580 wrote to memory of 2240 1580 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 83 PID 1580 wrote to memory of 2240 1580 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 83 PID 1580 wrote to memory of 2240 1580 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 83 PID 1580 wrote to memory of 2240 1580 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 83 PID 2240 wrote to memory of 4708 2240 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 84 PID 2240 wrote to memory of 4708 2240 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 84 PID 2240 wrote to memory of 4708 2240 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 84 PID 2240 wrote to memory of 4708 2240 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 84 PID 4708 wrote to memory of 1976 4708 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 85 PID 4708 wrote to memory of 1976 4708 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 85 PID 4708 wrote to memory of 1976 4708 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 85 PID 4708 wrote to memory of 1976 4708 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 85 PID 1976 wrote to memory of 452 1976 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 86 PID 1976 wrote to memory of 452 1976 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 86 PID 1976 wrote to memory of 452 1976 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 86 PID 1976 wrote to memory of 452 1976 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 86 PID 452 wrote to memory of 2504 452 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 87 PID 452 wrote to memory of 2504 452 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 87 PID 452 wrote to memory of 2504 452 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 87 PID 452 wrote to memory of 2504 452 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 87 PID 2504 wrote to memory of 2264 2504 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 88 PID 2504 wrote to memory of 2264 2504 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 88 PID 2504 wrote to memory of 2264 2504 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 88 PID 2504 wrote to memory of 2264 2504 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 88 PID 2264 wrote to memory of 3948 2264 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 89 PID 2264 wrote to memory of 3948 2264 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 89 PID 2264 wrote to memory of 3948 2264 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 89 PID 2264 wrote to memory of 3948 2264 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 89 PID 3948 wrote to memory of 5116 3948 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 90 PID 3948 wrote to memory of 5116 3948 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 90 PID 3948 wrote to memory of 5116 3948 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 90 PID 3948 wrote to memory of 5116 3948 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 90 PID 5116 wrote to memory of 1988 5116 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 91 PID 5116 wrote to memory of 1988 5116 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 91 PID 5116 wrote to memory of 1988 5116 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 91 PID 5116 wrote to memory of 1988 5116 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 91 PID 1988 wrote to memory of 4304 1988 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 92 PID 1988 wrote to memory of 4304 1988 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 92 PID 1988 wrote to memory of 4304 1988 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 92 PID 1988 wrote to memory of 4304 1988 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 92 PID 4304 wrote to memory of 3244 4304 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 93 PID 4304 wrote to memory of 3244 4304 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 93 PID 4304 wrote to memory of 3244 4304 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 93 PID 4304 wrote to memory of 3244 4304 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 93 PID 3244 wrote to memory of 1920 3244 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 94 PID 3244 wrote to memory of 1920 3244 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 94 PID 3244 wrote to memory of 1920 3244 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 94 PID 3244 wrote to memory of 1920 3244 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 94 PID 1920 wrote to memory of 2064 1920 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 95 PID 1920 wrote to memory of 2064 1920 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 95 PID 1920 wrote to memory of 2064 1920 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 95 PID 1920 wrote to memory of 2064 1920 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 95 PID 2064 wrote to memory of 1656 2064 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 96 PID 2064 wrote to memory of 1656 2064 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 96 PID 2064 wrote to memory of 1656 2064 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 96 PID 2064 wrote to memory of 1656 2064 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 96 PID 1656 wrote to memory of 4872 1656 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 97 PID 1656 wrote to memory of 4872 1656 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 97 PID 1656 wrote to memory of 4872 1656 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 97 PID 1656 wrote to memory of 4872 1656 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 97 PID 4872 wrote to memory of 2524 4872 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 98 PID 4872 wrote to memory of 2524 4872 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 98 PID 4872 wrote to memory of 2524 4872 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 98 PID 4872 wrote to memory of 2524 4872 abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe5⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe8⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe9⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe10⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe11⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe13⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe14⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe15⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe16⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe17⤵
- Suspicious use of SetThreadContext
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe18⤵
- Suspicious use of SetThreadContext
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe19⤵
- Suspicious use of SetThreadContext
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe20⤵
- Suspicious use of SetThreadContext
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe21⤵
- Suspicious use of SetThreadContext
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe22⤵
- Suspicious use of SetThreadContext
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe23⤵
- Suspicious use of SetThreadContext
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe24⤵
- Suspicious use of SetThreadContext
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe25⤵
- Suspicious use of SetThreadContext
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe26⤵
- Suspicious use of SetThreadContext
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe27⤵
- Suspicious use of SetThreadContext
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe28⤵
- Suspicious use of SetThreadContext
PID:208 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe29⤵
- Suspicious use of SetThreadContext
PID:392 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe30⤵
- Suspicious use of SetThreadContext
PID:656 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe31⤵
- Suspicious use of SetThreadContext
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe32⤵
- Suspicious use of SetThreadContext
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe33⤵
- Suspicious use of SetThreadContext
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe34⤵
- Suspicious use of SetThreadContext
PID:456 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe35⤵
- Suspicious use of SetThreadContext
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe36⤵
- Suspicious use of SetThreadContext
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe37⤵
- Suspicious use of SetThreadContext
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe38⤵
- Suspicious use of SetThreadContext
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe39⤵
- Suspicious use of SetThreadContext
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe40⤵
- Suspicious use of SetThreadContext
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe41⤵
- Suspicious use of SetThreadContext
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe42⤵
- Suspicious use of SetThreadContext
PID:440 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe43⤵
- Suspicious use of SetThreadContext
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe44⤵
- Suspicious use of SetThreadContext
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe45⤵
- Suspicious use of SetThreadContext
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe46⤵
- Suspicious use of SetThreadContext
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe47⤵
- Suspicious use of SetThreadContext
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe48⤵
- Suspicious use of SetThreadContext
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe49⤵
- Suspicious use of SetThreadContext
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe50⤵
- Suspicious use of SetThreadContext
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe51⤵
- Suspicious use of SetThreadContext
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe52⤵
- Suspicious use of SetThreadContext
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe53⤵
- Suspicious use of SetThreadContext
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe54⤵
- Suspicious use of SetThreadContext
PID:924 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe55⤵
- Suspicious use of SetThreadContext
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe56⤵
- Suspicious use of SetThreadContext
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe57⤵
- Suspicious use of SetThreadContext
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe58⤵
- Suspicious use of SetThreadContext
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe59⤵
- Suspicious use of SetThreadContext
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe60⤵
- Suspicious use of SetThreadContext
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe61⤵
- Suspicious use of SetThreadContext
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe62⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe63⤵
- Suspicious use of SetThreadContext
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe64⤵
- Suspicious use of SetThreadContext
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe65⤵
- Suspicious use of SetThreadContext
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe66⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe67⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe68⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe69⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe70⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe71⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe72⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe73⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe74⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe75⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe76⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe77⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe78⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe79⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe80⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe81⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe82⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe83⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe84⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe85⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe86⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe87⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe88⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe89⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe90⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe91⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe92⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe93⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe94⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe95⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe96⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe97⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe98⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe99⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe100⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe101⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe102⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe103⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe104⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe105⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe106⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe107⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe108⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe109⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe110⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe111⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe112⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe113⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe114⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe115⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe116⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe117⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe118⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe119⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe120⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe121⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\abad1497b4cf0ea1ab2b3d2abce5a001_JaffaCakes118.exe122⤵PID:1084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-