Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 21:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe
-
Size
208KB
-
MD5
973a4afe610f308841c89d3ba54c3486
-
SHA1
3903878bb6c51c33681a693c128e5fe8872cdf3b
-
SHA256
b717b795c1b809d8613992490d030b729d590a48e4f5e1233431ef3bce1b0d56
-
SHA512
19a1f5dd3bb9c310b56239ed92551c57b0f201e99532cd77ca04d1d55022112eacfc1a84372f1781cc1f1beed212b5df9a2239cc2ec44a43a24b20c2db1f04ae
-
SSDEEP
6144:X17R4t23DRTWadm4BpX8ntjv6s4amwMURgF/:z+cDRCadVpX8nt7cCQ/
Malware Config
Extracted
Family
gozi
Signatures
-
Gozi family
-
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 2552 set thread context of 4188 2552 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 82 PID 4188 set thread context of 3556 4188 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 83 PID 3556 set thread context of 1604 3556 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 84 PID 1604 set thread context of 1116 1604 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 85 PID 1116 set thread context of 740 1116 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 86 PID 740 set thread context of 1468 740 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 87 PID 1468 set thread context of 4368 1468 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 88 PID 4368 set thread context of 1496 4368 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 89 PID 1496 set thread context of 216 1496 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 90 PID 216 set thread context of 4164 216 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 91 PID 4164 set thread context of 4224 4164 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 92 PID 4224 set thread context of 876 4224 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 93 PID 876 set thread context of 824 876 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 94 PID 824 set thread context of 228 824 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 95 PID 228 set thread context of 1068 228 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 96 PID 1068 set thread context of 1976 1068 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 97 PID 1976 set thread context of 3584 1976 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 98 PID 3584 set thread context of 2176 3584 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 99 PID 2176 set thread context of 4888 2176 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 100 PID 4888 set thread context of 980 4888 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 101 PID 980 set thread context of 2388 980 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 102 PID 2388 set thread context of 3912 2388 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 103 PID 3912 set thread context of 4552 3912 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 104 PID 4552 set thread context of 4672 4552 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 105 PID 4672 set thread context of 4004 4672 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 108 PID 4004 set thread context of 2332 4004 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 109 PID 2332 set thread context of 2596 2332 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 110 PID 2596 set thread context of 4972 2596 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 111 PID 4972 set thread context of 4012 4972 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 112 PID 4012 set thread context of 2912 4012 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 113 PID 2912 set thread context of 4448 2912 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 115 PID 4448 set thread context of 4744 4448 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 117 PID 4744 set thread context of 3536 4744 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 118 PID 3536 set thread context of 1504 3536 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 119 PID 1504 set thread context of 2320 1504 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 120 PID 2320 set thread context of 1848 2320 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 121 PID 1848 set thread context of 3568 1848 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 122 PID 3568 set thread context of 3268 3568 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 123 PID 3268 set thread context of 4844 3268 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 124 PID 4844 set thread context of 1824 4844 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 125 PID 1824 set thread context of 1548 1824 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 126 PID 1548 set thread context of 4252 1548 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 127 PID 4252 set thread context of 452 4252 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 128 PID 452 set thread context of 1040 452 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 129 PID 1040 set thread context of 3136 1040 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 130 PID 3136 set thread context of 892 3136 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 131 PID 892 set thread context of 4860 892 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 132 PID 4860 set thread context of 4388 4860 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 133 PID 4388 set thread context of 1456 4388 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 134 PID 1456 set thread context of 4988 1456 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 135 PID 4988 set thread context of 1404 4988 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 137 PID 1404 set thread context of 1192 1404 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 138 PID 1192 set thread context of 2500 1192 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 139 PID 2500 set thread context of 2832 2500 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 140 PID 2832 set thread context of 3480 2832 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 141 PID 3480 set thread context of 2764 3480 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 142 PID 2764 set thread context of 668 2764 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 143 PID 668 set thread context of 916 668 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 144 PID 916 set thread context of 4596 916 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 145 PID 4596 set thread context of 4412 4596 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 146 PID 4412 set thread context of 3140 4412 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 147 PID 3140 set thread context of 536 3140 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 148 PID 536 set thread context of 2140 536 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 149 PID 2140 set thread context of 4060 2140 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 150 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2552 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4188 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 3556 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1604 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1116 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 740 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1468 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4368 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1496 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 216 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4164 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4224 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 876 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 824 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 228 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1068 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1976 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 3584 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2176 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4888 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 980 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2388 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 3912 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4552 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4672 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4004 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2332 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2596 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4972 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4012 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2912 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4448 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4744 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 3536 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1504 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2320 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1848 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 3568 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 3268 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4844 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1824 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1548 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4252 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 452 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1040 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 3136 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 892 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4860 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4388 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1456 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4988 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1404 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 1192 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2500 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2832 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 3480 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2764 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 668 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 916 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4596 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 4412 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 3140 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 536 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 2140 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2552 wrote to memory of 4188 2552 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 82 PID 2552 wrote to memory of 4188 2552 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 82 PID 2552 wrote to memory of 4188 2552 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 82 PID 2552 wrote to memory of 4188 2552 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 82 PID 2552 wrote to memory of 4188 2552 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 82 PID 2552 wrote to memory of 4188 2552 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 82 PID 2552 wrote to memory of 4188 2552 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 82 PID 2552 wrote to memory of 4188 2552 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 82 PID 2552 wrote to memory of 4188 2552 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 82 PID 2552 wrote to memory of 4188 2552 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 82 PID 4188 wrote to memory of 3556 4188 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 83 PID 4188 wrote to memory of 3556 4188 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 83 PID 4188 wrote to memory of 3556 4188 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 83 PID 4188 wrote to memory of 3556 4188 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 83 PID 4188 wrote to memory of 3556 4188 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 83 PID 4188 wrote to memory of 3556 4188 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 83 PID 4188 wrote to memory of 3556 4188 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 83 PID 4188 wrote to memory of 3556 4188 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 83 PID 4188 wrote to memory of 3556 4188 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 83 PID 4188 wrote to memory of 3556 4188 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 83 PID 3556 wrote to memory of 1604 3556 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 84 PID 3556 wrote to memory of 1604 3556 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 84 PID 3556 wrote to memory of 1604 3556 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 84 PID 3556 wrote to memory of 1604 3556 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 84 PID 3556 wrote to memory of 1604 3556 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 84 PID 3556 wrote to memory of 1604 3556 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 84 PID 3556 wrote to memory of 1604 3556 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 84 PID 3556 wrote to memory of 1604 3556 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 84 PID 3556 wrote to memory of 1604 3556 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 84 PID 3556 wrote to memory of 1604 3556 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 84 PID 1604 wrote to memory of 1116 1604 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 85 PID 1604 wrote to memory of 1116 1604 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 85 PID 1604 wrote to memory of 1116 1604 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 85 PID 1604 wrote to memory of 1116 1604 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 85 PID 1604 wrote to memory of 1116 1604 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 85 PID 1604 wrote to memory of 1116 1604 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 85 PID 1604 wrote to memory of 1116 1604 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 85 PID 1604 wrote to memory of 1116 1604 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 85 PID 1604 wrote to memory of 1116 1604 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 85 PID 1604 wrote to memory of 1116 1604 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 85 PID 1116 wrote to memory of 740 1116 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 86 PID 1116 wrote to memory of 740 1116 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 86 PID 1116 wrote to memory of 740 1116 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 86 PID 1116 wrote to memory of 740 1116 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 86 PID 1116 wrote to memory of 740 1116 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 86 PID 1116 wrote to memory of 740 1116 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 86 PID 1116 wrote to memory of 740 1116 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 86 PID 1116 wrote to memory of 740 1116 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 86 PID 1116 wrote to memory of 740 1116 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 86 PID 1116 wrote to memory of 740 1116 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 86 PID 740 wrote to memory of 1468 740 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 87 PID 740 wrote to memory of 1468 740 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 87 PID 740 wrote to memory of 1468 740 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 87 PID 740 wrote to memory of 1468 740 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 87 PID 740 wrote to memory of 1468 740 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 87 PID 740 wrote to memory of 1468 740 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 87 PID 740 wrote to memory of 1468 740 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 87 PID 740 wrote to memory of 1468 740 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 87 PID 740 wrote to memory of 1468 740 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 87 PID 740 wrote to memory of 1468 740 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 87 PID 1468 wrote to memory of 4368 1468 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 88 PID 1468 wrote to memory of 4368 1468 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 88 PID 1468 wrote to memory of 4368 1468 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 88 PID 1468 wrote to memory of 4368 1468 973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe5⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe8⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe9⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe10⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:216 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe11⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe12⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe13⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:876 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe14⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:824 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe15⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:228 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe16⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe17⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe18⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe19⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe20⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe21⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:980 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe22⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe23⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe24⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe25⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe26⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe27⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe28⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe29⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe30⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe31⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe32⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe33⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe34⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe35⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe36⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe37⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe38⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe39⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe40⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe41⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe42⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe43⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe44⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:452 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe45⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe46⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe47⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:892 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe48⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe49⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe50⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe51⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe52⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe53⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe54⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe55⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe56⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe57⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe58⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:668 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe59⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:916 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe60⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe61⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe62⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe63⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:536 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe64⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe65⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe66⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe67⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe68⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe69⤵
- System Location Discovery: System Language Discovery
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe70⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe71⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe72⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe73⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe74⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe75⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe76⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe77⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe78⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe79⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe80⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe81⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe82⤵
- System Location Discovery: System Language Discovery
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe83⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe84⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe85⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe86⤵
- System Location Discovery: System Language Discovery
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe87⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe88⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe89⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe90⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe91⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe92⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe93⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe94⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe95⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe96⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe97⤵
- System Location Discovery: System Language Discovery
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe98⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe99⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe100⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe101⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe102⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe103⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe104⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe105⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe106⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe107⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe108⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe109⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe110⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe111⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe112⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe113⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe114⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe115⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe116⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe117⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe118⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe119⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe120⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe121⤵
- System Location Discovery: System Language Discovery
PID:852 -
C:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\973a4afe610f308841c89d3ba54c3486_JaffaCakes118.exe122⤵PID:4428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-