Malware Analysis Report

2025-08-11 07:49

Sample ID 241029-2lcnbssndm
Target 7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118
SHA256 2432b6162e67009a808cef4b72c678c29843e450457f6a07c789a8ba35695051
Tags
darkcomet victim discovery rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2432b6162e67009a808cef4b72c678c29843e450457f6a07c789a8ba35695051

Threat Level: Known bad

The file 7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

darkcomet victim discovery rat trojan upx

Darkcomet family

Darkcomet

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Suspicious use of SetThreadContext

UPX packed file

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-29 22:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-29 22:39

Reported

2024-10-29 22:42

Platform

win7-20240903-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2404 set thread context of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2404 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2404 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2404 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2404 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2404 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2404 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2404 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2404 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2404 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2404 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2404 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2404 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 2404 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 truehack.no-ip.biz udp

Files

memory/2404-0-0x0000000074BB1000-0x0000000074BB2000-memory.dmp

memory/2404-1-0x0000000074BB0000-0x000000007515B000-memory.dmp

memory/2404-2-0x0000000074BB0000-0x000000007515B000-memory.dmp

memory/1956-7-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1956-15-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1956-11-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1956-16-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1956-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1956-17-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1956-9-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1956-19-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1956-23-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1956-22-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1956-21-0x0000000000400000-0x00000000004BA000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

MD5 1efd527286c183608fa350f24501ceea
SHA1 f8f83f86a4967f326274b98af1da03857a910052
SHA256 95df0bdc292aaf16fab3a9f930b1845ff0209ec6c3ae45f42e8969ed82f34cd0
SHA512 15d7242e721cb196e0504c47ca66f3ef44cfcba442e787b3d58a42c1146f5aacd939b2204a29e4dd1b361ed832d9a57e47b9f94548bfa90bfca0e13f9d578a98

memory/1956-29-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1956-30-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/2404-34-0x0000000074BB0000-0x000000007515B000-memory.dmp

memory/1956-35-0x0000000000400000-0x00000000004BA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-29 22:39

Reported

2024-10-29 22:42

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5064 set thread context of 1424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 36 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5064 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5064 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5064 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5064 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5064 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5064 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5064 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5064 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5064 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
PID 5064 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7cfb602fba2283c98ca2890d342f95fd_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 truehack.no-ip.biz udp
US 8.8.8.8:53 udp

Files

memory/5064-0-0x0000000074BE2000-0x0000000074BE3000-memory.dmp

memory/5064-1-0x0000000074BE0000-0x0000000075191000-memory.dmp

memory/5064-2-0x0000000074BE0000-0x0000000075191000-memory.dmp

memory/1424-7-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1424-8-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1424-9-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1424-11-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1424-10-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1424-12-0x0000000000B20000-0x0000000000B21000-memory.dmp

memory/1424-13-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1424-14-0x0000000000400000-0x00000000004BA000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

MD5 1efd527286c183608fa350f24501ceea
SHA1 f8f83f86a4967f326274b98af1da03857a910052
SHA256 95df0bdc292aaf16fab3a9f930b1845ff0209ec6c3ae45f42e8969ed82f34cd0
SHA512 15d7242e721cb196e0504c47ca66f3ef44cfcba442e787b3d58a42c1146f5aacd939b2204a29e4dd1b361ed832d9a57e47b9f94548bfa90bfca0e13f9d578a98

memory/4140-25-0x0000000074BE2000-0x0000000074BE3000-memory.dmp

memory/4140-26-0x0000000074BE0000-0x0000000075191000-memory.dmp

memory/4140-27-0x0000000074BE0000-0x0000000075191000-memory.dmp

memory/5064-28-0x0000000074BE2000-0x0000000074BE3000-memory.dmp

memory/5064-29-0x0000000074BE0000-0x0000000075191000-memory.dmp

memory/4140-31-0x0000000074BE0000-0x0000000075191000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\VSCover.exe.log

MD5 1754173b0ed4624c61fcf04f894e5bb6
SHA1 2fbf7999a2e14f19c9aeb1ac0e58b8a3859368b1
SHA256 19e1f5731300f62cc4bb6eac90e96b7ff5de1bf8c13a434f1a7e38ee6927d757
SHA512 63ae7b7da19c5b65ce73565042cf7386c8d53ab6645b901a9f684d5039e28addd91938d8d61cec153b675e80c25d92fae62bff53edf19914643c94f3a56db710

memory/5064-34-0x0000000074BE0000-0x0000000075191000-memory.dmp