Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2024 18:36
Behavioral task
behavioral1
Sample
ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe
-
Size
59KB
-
MD5
ee322efe764b4c19e0e3b9a150dae07f
-
SHA1
fa70fa50dabf87ea96ec1eda5f5870a241e1e301
-
SHA256
edf453626c23287376f44e58445212c8ce43d4eab50b21b485f86be4a7ba938c
-
SHA512
7d658fd2466805e560ec7abb30d89f72bfa2cc2e11603e11a58abb31383041d4575f44dfe35bddf09037bd756cecfdc3c9ba8931ea8f24981fa7f80941589c8e
-
SSDEEP
768:0wwyxQoQEWjSHD23fbU50aaaxwdYzsRew8rt9pof62JWTYNpt9QLjZB3xIob+S+H:Rijqi5axwdcPpo7SStSI3SY1hl
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 64 IoCs
resource yara_rule behavioral2/memory/1560-0-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/2320-1-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4436-2-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/1080-3-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/1208-4-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4204-5-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3980-6-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3592-7-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/5012-8-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4092-9-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3792-10-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/2952-11-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4804-12-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/2016-13-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4156-14-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3336-15-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/1040-16-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/2220-17-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4548-18-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4632-19-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4640-20-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/1964-21-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/2740-22-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3860-23-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3244-24-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3304-25-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3064-26-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/244-27-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/2340-28-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/2660-29-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4000-30-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/2468-31-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3312-32-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3904-33-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4684-34-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/2500-35-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/1884-36-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/2132-37-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4852-38-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4592-40-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/2888-39-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4468-41-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/1876-42-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4956-43-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3352-44-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/2380-45-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3544-46-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3004-47-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3484-48-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4908-49-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4972-50-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/1948-51-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4520-52-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4892-53-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/2028-54-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3744-55-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/928-56-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3164-57-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4564-58-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4244-59-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/704-60-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/2212-61-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/4772-62-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 behavioral2/memory/3260-63-0x0000000010000000-0x0000000010015000-memory.dmp modiloader_stage2 -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 1560 set thread context of 2320 1560 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 82 PID 2320 set thread context of 4436 2320 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 83 PID 4436 set thread context of 1080 4436 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 84 PID 1080 set thread context of 1208 1080 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 85 PID 1208 set thread context of 4204 1208 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 86 PID 4204 set thread context of 3980 4204 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 87 PID 3980 set thread context of 3592 3980 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 88 PID 3592 set thread context of 5012 3592 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 89 PID 5012 set thread context of 4092 5012 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 90 PID 4092 set thread context of 3792 4092 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 91 PID 3792 set thread context of 2952 3792 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 92 PID 2952 set thread context of 4804 2952 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 93 PID 4804 set thread context of 2016 4804 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 94 PID 2016 set thread context of 4156 2016 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 95 PID 4156 set thread context of 3336 4156 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 96 PID 3336 set thread context of 1040 3336 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 97 PID 1040 set thread context of 2220 1040 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 98 PID 2220 set thread context of 4548 2220 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 99 PID 4548 set thread context of 4632 4548 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 100 PID 4632 set thread context of 4640 4632 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 101 PID 4640 set thread context of 1964 4640 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 102 PID 1964 set thread context of 2740 1964 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 103 PID 2740 set thread context of 3860 2740 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 104 PID 3860 set thread context of 3244 3860 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 105 PID 3244 set thread context of 3304 3244 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 106 PID 3304 set thread context of 3064 3304 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 107 PID 3064 set thread context of 244 3064 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 108 PID 244 set thread context of 2340 244 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 109 PID 2340 set thread context of 2660 2340 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 110 PID 2660 set thread context of 4000 2660 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 111 PID 4000 set thread context of 2468 4000 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 112 PID 2468 set thread context of 3312 2468 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 113 PID 3312 set thread context of 3904 3312 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 114 PID 3904 set thread context of 4684 3904 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 115 PID 4684 set thread context of 2500 4684 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 116 PID 2500 set thread context of 1884 2500 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 117 PID 1884 set thread context of 2132 1884 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 118 PID 2132 set thread context of 4852 2132 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 119 PID 4852 set thread context of 2888 4852 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 120 PID 2888 set thread context of 4592 2888 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 121 PID 4592 set thread context of 4468 4592 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 122 PID 4468 set thread context of 1876 4468 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 123 PID 1876 set thread context of 4956 1876 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 124 PID 4956 set thread context of 3352 4956 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 125 PID 3352 set thread context of 2380 3352 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 126 PID 2380 set thread context of 3544 2380 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 127 PID 3544 set thread context of 3004 3544 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 128 PID 3004 set thread context of 3484 3004 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 129 PID 3484 set thread context of 4908 3484 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 130 PID 4908 set thread context of 4972 4908 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 131 PID 4972 set thread context of 1948 4972 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 132 PID 1948 set thread context of 4520 1948 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 133 PID 4520 set thread context of 4892 4520 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 134 PID 4892 set thread context of 2028 4892 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 135 PID 2028 set thread context of 3744 2028 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 136 PID 3744 set thread context of 928 3744 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 137 PID 928 set thread context of 3164 928 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 138 PID 3164 set thread context of 4564 3164 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 139 PID 4564 set thread context of 4244 4564 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 140 PID 4244 set thread context of 704 4244 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 141 PID 704 set thread context of 2212 704 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 142 PID 2212 set thread context of 4772 2212 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 143 PID 4772 set thread context of 3260 4772 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 144 PID 3260 set thread context of 2572 3260 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 145 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1560 wrote to memory of 2320 1560 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 82 PID 1560 wrote to memory of 2320 1560 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 82 PID 1560 wrote to memory of 2320 1560 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 82 PID 1560 wrote to memory of 2320 1560 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 82 PID 2320 wrote to memory of 4436 2320 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 83 PID 2320 wrote to memory of 4436 2320 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 83 PID 2320 wrote to memory of 4436 2320 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 83 PID 2320 wrote to memory of 4436 2320 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 83 PID 4436 wrote to memory of 1080 4436 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 84 PID 4436 wrote to memory of 1080 4436 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 84 PID 4436 wrote to memory of 1080 4436 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 84 PID 4436 wrote to memory of 1080 4436 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 84 PID 1080 wrote to memory of 1208 1080 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 85 PID 1080 wrote to memory of 1208 1080 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 85 PID 1080 wrote to memory of 1208 1080 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 85 PID 1080 wrote to memory of 1208 1080 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 85 PID 1208 wrote to memory of 4204 1208 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 86 PID 1208 wrote to memory of 4204 1208 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 86 PID 1208 wrote to memory of 4204 1208 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 86 PID 1208 wrote to memory of 4204 1208 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 86 PID 4204 wrote to memory of 3980 4204 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 87 PID 4204 wrote to memory of 3980 4204 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 87 PID 4204 wrote to memory of 3980 4204 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 87 PID 4204 wrote to memory of 3980 4204 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 87 PID 3980 wrote to memory of 3592 3980 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 88 PID 3980 wrote to memory of 3592 3980 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 88 PID 3980 wrote to memory of 3592 3980 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 88 PID 3980 wrote to memory of 3592 3980 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 88 PID 3592 wrote to memory of 5012 3592 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 89 PID 3592 wrote to memory of 5012 3592 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 89 PID 3592 wrote to memory of 5012 3592 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 89 PID 3592 wrote to memory of 5012 3592 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 89 PID 5012 wrote to memory of 4092 5012 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 90 PID 5012 wrote to memory of 4092 5012 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 90 PID 5012 wrote to memory of 4092 5012 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 90 PID 5012 wrote to memory of 4092 5012 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 90 PID 4092 wrote to memory of 3792 4092 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 91 PID 4092 wrote to memory of 3792 4092 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 91 PID 4092 wrote to memory of 3792 4092 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 91 PID 4092 wrote to memory of 3792 4092 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 91 PID 3792 wrote to memory of 2952 3792 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 92 PID 3792 wrote to memory of 2952 3792 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 92 PID 3792 wrote to memory of 2952 3792 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 92 PID 3792 wrote to memory of 2952 3792 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 92 PID 2952 wrote to memory of 4804 2952 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 93 PID 2952 wrote to memory of 4804 2952 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 93 PID 2952 wrote to memory of 4804 2952 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 93 PID 2952 wrote to memory of 4804 2952 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 93 PID 4804 wrote to memory of 2016 4804 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 94 PID 4804 wrote to memory of 2016 4804 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 94 PID 4804 wrote to memory of 2016 4804 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 94 PID 4804 wrote to memory of 2016 4804 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 94 PID 2016 wrote to memory of 4156 2016 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 95 PID 2016 wrote to memory of 4156 2016 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 95 PID 2016 wrote to memory of 4156 2016 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 95 PID 2016 wrote to memory of 4156 2016 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 95 PID 4156 wrote to memory of 3336 4156 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 96 PID 4156 wrote to memory of 3336 4156 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 96 PID 4156 wrote to memory of 3336 4156 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 96 PID 4156 wrote to memory of 3336 4156 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 96 PID 3336 wrote to memory of 1040 3336 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 97 PID 3336 wrote to memory of 1040 3336 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 97 PID 3336 wrote to memory of 1040 3336 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 97 PID 3336 wrote to memory of 1040 3336 ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe5⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe8⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe9⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe10⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe11⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe13⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe14⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe15⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe16⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe17⤵
- Suspicious use of SetThreadContext
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe18⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe19⤵
- Suspicious use of SetThreadContext
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe20⤵
- Suspicious use of SetThreadContext
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe21⤵
- Suspicious use of SetThreadContext
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe22⤵
- Suspicious use of SetThreadContext
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe23⤵
- Suspicious use of SetThreadContext
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe24⤵
- Suspicious use of SetThreadContext
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe25⤵
- Suspicious use of SetThreadContext
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe26⤵
- Suspicious use of SetThreadContext
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe27⤵
- Suspicious use of SetThreadContext
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe28⤵
- Suspicious use of SetThreadContext
PID:244 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe29⤵
- Suspicious use of SetThreadContext
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe30⤵
- Suspicious use of SetThreadContext
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe31⤵
- Suspicious use of SetThreadContext
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe32⤵
- Suspicious use of SetThreadContext
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe33⤵
- Suspicious use of SetThreadContext
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe34⤵
- Suspicious use of SetThreadContext
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe35⤵
- Suspicious use of SetThreadContext
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe36⤵
- Suspicious use of SetThreadContext
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe37⤵
- Suspicious use of SetThreadContext
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe38⤵
- Suspicious use of SetThreadContext
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe39⤵
- Suspicious use of SetThreadContext
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe40⤵
- Suspicious use of SetThreadContext
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe41⤵
- Suspicious use of SetThreadContext
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe42⤵
- Suspicious use of SetThreadContext
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe43⤵
- Suspicious use of SetThreadContext
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe44⤵
- Suspicious use of SetThreadContext
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe45⤵
- Suspicious use of SetThreadContext
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe46⤵
- Suspicious use of SetThreadContext
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe47⤵
- Suspicious use of SetThreadContext
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe48⤵
- Suspicious use of SetThreadContext
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe49⤵
- Suspicious use of SetThreadContext
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe50⤵
- Suspicious use of SetThreadContext
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe51⤵
- Suspicious use of SetThreadContext
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe52⤵
- Suspicious use of SetThreadContext
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe53⤵
- Suspicious use of SetThreadContext
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe54⤵
- Suspicious use of SetThreadContext
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe55⤵
- Suspicious use of SetThreadContext
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe56⤵
- Suspicious use of SetThreadContext
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe57⤵
- Suspicious use of SetThreadContext
PID:928 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe58⤵
- Suspicious use of SetThreadContext
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe59⤵
- Suspicious use of SetThreadContext
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe60⤵
- Suspicious use of SetThreadContext
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe61⤵
- Suspicious use of SetThreadContext
PID:704 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe62⤵
- Suspicious use of SetThreadContext
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe63⤵
- Suspicious use of SetThreadContext
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe64⤵
- Suspicious use of SetThreadContext
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe65⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe66⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe67⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe68⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe69⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe70⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe71⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe72⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe73⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe74⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe75⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe76⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe77⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe78⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe79⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe80⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe81⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe82⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe83⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe84⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe85⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe86⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe87⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe88⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe89⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe90⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe91⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe92⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe93⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe94⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe95⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe96⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe97⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe98⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe99⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe100⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe101⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe102⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe103⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe104⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe105⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe106⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe107⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe108⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe109⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe110⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe111⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe112⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe113⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe114⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe115⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe116⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe117⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe118⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe119⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe120⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe121⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ee322efe764b4c19e0e3b9a150dae07f_JaffaCakes118.exe122⤵PID:3880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-