Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 21:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe
-
Size
208KB
-
MD5
973a4afe610f308841c89d3ba54c3486
-
SHA1
3903878bb6c51c33681a693c128e5fe8872cdf3b
-
SHA256
b717b795c1b809d8613992490d030b729d590a48e4f5e1233431ef3bce1b0d56
-
SHA512
19a1f5dd3bb9c310b56239ed92551c57b0f201e99532cd77ca04d1d55022112eacfc1a84372f1781cc1f1beed212b5df9a2239cc2ec44a43a24b20c2db1f04ae
-
SSDEEP
6144:X17R4t23DRTWadm4BpX8ntjv6s4amwMURgF/:z+cDRCadVpX8nt7cCQ/
Malware Config
Extracted
Family
gozi
Signatures
-
Gozi family
-
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 1924 set thread context of 2376 1924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 30 PID 2376 set thread context of 768 2376 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 31 PID 768 set thread context of 2228 768 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 32 PID 2228 set thread context of 2264 2228 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 33 PID 2264 set thread context of 2760 2264 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 34 PID 2760 set thread context of 2880 2760 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 35 PID 2880 set thread context of 2924 2880 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 36 PID 2924 set thread context of 2912 2924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 37 PID 2912 set thread context of 2860 2912 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 38 PID 2860 set thread context of 2620 2860 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 39 PID 2620 set thread context of 2692 2620 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 40 PID 2692 set thread context of 2088 2692 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 41 PID 2088 set thread context of 2864 2088 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 42 PID 2864 set thread context of 3012 2864 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 43 PID 3012 set thread context of 572 3012 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 44 PID 572 set thread context of 2932 572 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 45 PID 2932 set thread context of 2928 2932 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 46 PID 2928 set thread context of 588 2928 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 47 PID 588 set thread context of 3028 588 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 48 PID 3028 set thread context of 2656 3028 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 49 PID 2656 set thread context of 2400 2656 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 50 PID 2400 set thread context of 1700 2400 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 51 PID 1700 set thread context of 1832 1700 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 52 PID 1832 set thread context of 408 1832 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 53 PID 408 set thread context of 824 408 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 54 PID 824 set thread context of 680 824 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 55 PID 680 set thread context of 2000 680 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 56 PID 2000 set thread context of 660 2000 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 57 PID 660 set thread context of 1940 660 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 58 PID 1940 set thread context of 924 1940 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 59 PID 924 set thread context of 1140 924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 60 PID 1140 set thread context of 2100 1140 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 61 PID 2100 set thread context of 1496 2100 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 62 PID 1496 set thread context of 1696 1496 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 63 PID 1696 set thread context of 2524 1696 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 64 PID 2524 set thread context of 2064 2524 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 65 PID 2064 set thread context of 1608 2064 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 66 PID 1608 set thread context of 3052 1608 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 67 PID 3052 set thread context of 2432 3052 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 68 PID 2432 set thread context of 2288 2432 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 69 PID 2288 set thread context of 2448 2288 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 70 PID 2448 set thread context of 2828 2448 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 71 PID 2828 set thread context of 2772 2828 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 72 PID 2772 set thread context of 2896 2772 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 73 PID 2896 set thread context of 2992 2896 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 74 PID 2992 set thread context of 2664 2992 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 75 PID 2664 set thread context of 2648 2664 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 76 PID 2648 set thread context of 2908 2648 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 77 PID 2908 set thread context of 2852 2908 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 78 PID 2852 set thread context of 2964 2852 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 79 PID 2964 set thread context of 1768 2964 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 80 PID 1768 set thread context of 1660 1768 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 81 PID 1660 set thread context of 2948 1660 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 82 PID 2948 set thread context of 3036 2948 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 83 PID 3036 set thread context of 812 3036 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 84 PID 812 set thread context of 1064 812 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 85 PID 1064 set thread context of 2340 1064 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 86 PID 2340 set thread context of 2404 2340 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 87 PID 2404 set thread context of 1676 2404 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 88 PID 1676 set thread context of 1892 1676 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 89 PID 1892 set thread context of 1632 1892 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 90 PID 1632 set thread context of 1084 1632 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 91 PID 1084 set thread context of 1912 1084 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 93 PID 1912 set thread context of 2104 1912 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 94 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2376 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 768 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2228 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2264 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2760 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2880 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2912 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2860 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2620 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2692 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2088 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2864 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 3012 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 572 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2932 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2928 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 588 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 3028 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2656 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2400 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1700 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1832 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 408 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 824 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 680 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2000 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 660 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1940 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1140 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2100 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1496 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1696 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2524 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2064 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1608 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 3052 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2432 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2288 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2448 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2828 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2772 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2896 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2992 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2664 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2648 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2908 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2852 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2964 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1768 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1660 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2948 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 3036 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 812 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1064 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2340 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2404 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1676 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1892 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1632 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1084 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1912 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2376 1924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2376 1924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2376 1924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2376 1924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2376 1924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2376 1924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2376 1924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2376 1924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2376 1924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2376 1924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2376 1924 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 30 PID 2376 wrote to memory of 768 2376 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 31 PID 2376 wrote to memory of 768 2376 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 31 PID 2376 wrote to memory of 768 2376 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 31 PID 2376 wrote to memory of 768 2376 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 31 PID 2376 wrote to memory of 768 2376 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 31 PID 2376 wrote to memory of 768 2376 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 31 PID 2376 wrote to memory of 768 2376 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 31 PID 2376 wrote to memory of 768 2376 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 31 PID 2376 wrote to memory of 768 2376 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 31 PID 2376 wrote to memory of 768 2376 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 31 PID 2376 wrote to memory of 768 2376 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 31 PID 768 wrote to memory of 2228 768 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 32 PID 768 wrote to memory of 2228 768 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 32 PID 768 wrote to memory of 2228 768 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 32 PID 768 wrote to memory of 2228 768 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 32 PID 768 wrote to memory of 2228 768 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 32 PID 768 wrote to memory of 2228 768 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 32 PID 768 wrote to memory of 2228 768 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 32 PID 768 wrote to memory of 2228 768 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 32 PID 768 wrote to memory of 2228 768 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 32 PID 768 wrote to memory of 2228 768 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 32 PID 768 wrote to memory of 2228 768 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 32 PID 2228 wrote to memory of 2264 2228 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 33 PID 2228 wrote to memory of 2264 2228 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 33 PID 2228 wrote to memory of 2264 2228 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 33 PID 2228 wrote to memory of 2264 2228 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 33 PID 2228 wrote to memory of 2264 2228 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 33 PID 2228 wrote to memory of 2264 2228 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 33 PID 2228 wrote to memory of 2264 2228 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 33 PID 2228 wrote to memory of 2264 2228 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 33 PID 2228 wrote to memory of 2264 2228 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 33 PID 2228 wrote to memory of 2264 2228 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 33 PID 2228 wrote to memory of 2264 2228 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 33 PID 2264 wrote to memory of 2760 2264 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 34 PID 2264 wrote to memory of 2760 2264 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 34 PID 2264 wrote to memory of 2760 2264 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 34 PID 2264 wrote to memory of 2760 2264 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 34 PID 2264 wrote to memory of 2760 2264 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 34 PID 2264 wrote to memory of 2760 2264 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 34 PID 2264 wrote to memory of 2760 2264 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 34 PID 2264 wrote to memory of 2760 2264 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 34 PID 2264 wrote to memory of 2760 2264 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 34 PID 2264 wrote to memory of 2760 2264 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 34 PID 2264 wrote to memory of 2760 2264 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 34 PID 2760 wrote to memory of 2880 2760 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 35 PID 2760 wrote to memory of 2880 2760 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 35 PID 2760 wrote to memory of 2880 2760 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 35 PID 2760 wrote to memory of 2880 2760 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 35 PID 2760 wrote to memory of 2880 2760 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 35 PID 2760 wrote to memory of 2880 2760 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 35 PID 2760 wrote to memory of 2880 2760 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 35 PID 2760 wrote to memory of 2880 2760 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 35 PID 2760 wrote to memory of 2880 2760 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe5⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe6⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe8⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe9⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe10⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe11⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe12⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe13⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe14⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe15⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe16⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:572 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe17⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe18⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe19⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:588 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe20⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe21⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe22⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe23⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe24⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe25⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:408 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe26⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:824 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe27⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:680 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe28⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe29⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:660 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe30⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe31⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:924 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe32⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe33⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe34⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe35⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe36⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe37⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe38⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe39⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe40⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe41⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe42⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe43⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe44⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe45⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe46⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe47⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe48⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe49⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe50⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe51⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe52⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe53⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe54⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe55⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe56⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:812 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe57⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe58⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe59⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe60⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe61⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe62⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe63⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe64⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe65⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe66⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe67⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe68⤵
- System Location Discovery: System Language Discovery
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe69⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe70⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe71⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe72⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe73⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe74⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe75⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe76⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe77⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe78⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe79⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe80⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe81⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe82⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe83⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe84⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe85⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe86⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe87⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe88⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe89⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe90⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe91⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe92⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe93⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe94⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe95⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe96⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe97⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe98⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe99⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe100⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe101⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe102⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe103⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe104⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe105⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe106⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe107⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe108⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe109⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe110⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe111⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe112⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe113⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe114⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe115⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe116⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe117⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe118⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe119⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe120⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe121⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe122⤵PID:1348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-