Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-12-2024 16:21
Behavioral task
behavioral1
Sample
da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe
-
Size
44KB
-
MD5
da7b35405eb24215b60549c9d52eccdb
-
SHA1
1d9be87cac21836df031ab4459728b3b6752313d
-
SHA256
5222d4c27c38fe0d273873807e3b8e278128f9a50c74d7047a7ffc0f973114e8
-
SHA512
3d82dea54358f603241087c310162b2670298332b2fc2f4adbf0def9514e160fb2f50b2ca7ea4aa223a417481a012dca84ca1c5e86203bdd47642e37cdc942ce
-
SSDEEP
768:1pllqXkTki5QbX47dSuFXQelZr2hPFef1hj8SuCjx7skt+o+2b4YbWIWL61Gr9:Zlq0TkuQsjAetG82kko+28yrWD9
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 64 IoCs
resource yara_rule behavioral2/memory/392-0-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4480-1-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3224-2-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/2364-3-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/1168-4-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4108-5-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4032-6-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/5116-7-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3296-8-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4476-9-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/2672-10-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/2844-11-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/1072-12-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/1952-13-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3468-14-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4616-15-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/216-16-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4028-17-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/5040-18-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4220-19-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3384-20-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4300-21-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3620-22-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3164-23-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3432-24-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/208-25-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3956-26-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3572-27-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/2764-28-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/1388-29-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3660-30-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4560-31-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/636-32-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3560-33-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/2192-34-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/2356-35-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/2224-36-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/1808-37-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3932-38-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/5008-39-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4804-40-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4568-41-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/2144-42-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3340-43-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/988-44-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3580-45-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3676-46-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/1588-47-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/5036-48-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3668-49-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4520-50-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4056-51-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/2444-52-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/2304-53-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/1040-54-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4680-55-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3096-56-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4572-57-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/2316-58-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4016-59-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3240-60-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/3972-61-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/4060-62-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 behavioral2/memory/1936-63-0x0000000019140000-0x0000000019151000-memory.dmp modiloader_stage2 -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 392 set thread context of 4480 392 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 83 PID 4480 set thread context of 3224 4480 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 84 PID 3224 set thread context of 2364 3224 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 85 PID 2364 set thread context of 1168 2364 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 86 PID 1168 set thread context of 4108 1168 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 87 PID 4108 set thread context of 4032 4108 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 88 PID 4032 set thread context of 5116 4032 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 89 PID 5116 set thread context of 3296 5116 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 90 PID 3296 set thread context of 4476 3296 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 91 PID 4476 set thread context of 2672 4476 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 92 PID 2672 set thread context of 2844 2672 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 93 PID 2844 set thread context of 1072 2844 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 94 PID 1072 set thread context of 1952 1072 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 95 PID 1952 set thread context of 3468 1952 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 96 PID 3468 set thread context of 4616 3468 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 97 PID 4616 set thread context of 216 4616 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 98 PID 216 set thread context of 4028 216 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 99 PID 4028 set thread context of 5040 4028 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 100 PID 5040 set thread context of 4220 5040 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 101 PID 4220 set thread context of 3384 4220 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 102 PID 3384 set thread context of 4300 3384 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 103 PID 4300 set thread context of 3620 4300 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 104 PID 3620 set thread context of 3164 3620 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 105 PID 3164 set thread context of 3432 3164 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 106 PID 3432 set thread context of 208 3432 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 107 PID 208 set thread context of 3956 208 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 108 PID 3956 set thread context of 3572 3956 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 109 PID 3572 set thread context of 2764 3572 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 110 PID 2764 set thread context of 1388 2764 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 190 PID 1388 set thread context of 3660 1388 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 112 PID 3660 set thread context of 4560 3660 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 113 PID 4560 set thread context of 636 4560 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 114 PID 636 set thread context of 3560 636 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 115 PID 3560 set thread context of 2192 3560 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 116 PID 2192 set thread context of 2356 2192 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 117 PID 2356 set thread context of 2224 2356 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 118 PID 2224 set thread context of 1808 2224 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 119 PID 1808 set thread context of 3932 1808 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 120 PID 3932 set thread context of 5008 3932 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 121 PID 5008 set thread context of 4804 5008 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 122 PID 4804 set thread context of 4568 4804 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 123 PID 4568 set thread context of 2144 4568 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 124 PID 2144 set thread context of 3340 2144 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 125 PID 3340 set thread context of 988 3340 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 126 PID 988 set thread context of 3580 988 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 127 PID 3580 set thread context of 3676 3580 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 207 PID 3676 set thread context of 1588 3676 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 208 PID 1588 set thread context of 5036 1588 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 130 PID 5036 set thread context of 3668 5036 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 211 PID 3668 set thread context of 4520 3668 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 132 PID 4520 set thread context of 4056 4520 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 133 PID 4056 set thread context of 2444 4056 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 134 PID 2444 set thread context of 2304 2444 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 135 PID 2304 set thread context of 1040 2304 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 218 PID 1040 set thread context of 4680 1040 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 137 PID 4680 set thread context of 3096 4680 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 138 PID 3096 set thread context of 4572 3096 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 139 PID 4572 set thread context of 2316 4572 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 140 PID 2316 set thread context of 4016 2316 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 141 PID 4016 set thread context of 3240 4016 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 142 PID 3240 set thread context of 3972 3240 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 143 PID 3972 set thread context of 4060 3972 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 144 PID 4060 set thread context of 1936 4060 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 145 PID 1936 set thread context of 2220 1936 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 146 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 392 wrote to memory of 4480 392 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 83 PID 392 wrote to memory of 4480 392 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 83 PID 392 wrote to memory of 4480 392 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 83 PID 392 wrote to memory of 4480 392 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 83 PID 4480 wrote to memory of 3224 4480 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 84 PID 4480 wrote to memory of 3224 4480 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 84 PID 4480 wrote to memory of 3224 4480 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 84 PID 4480 wrote to memory of 3224 4480 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 84 PID 3224 wrote to memory of 2364 3224 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 85 PID 3224 wrote to memory of 2364 3224 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 85 PID 3224 wrote to memory of 2364 3224 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 85 PID 3224 wrote to memory of 2364 3224 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 85 PID 2364 wrote to memory of 1168 2364 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 86 PID 2364 wrote to memory of 1168 2364 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 86 PID 2364 wrote to memory of 1168 2364 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 86 PID 2364 wrote to memory of 1168 2364 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 86 PID 1168 wrote to memory of 4108 1168 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 87 PID 1168 wrote to memory of 4108 1168 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 87 PID 1168 wrote to memory of 4108 1168 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 87 PID 1168 wrote to memory of 4108 1168 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 87 PID 4108 wrote to memory of 4032 4108 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 88 PID 4108 wrote to memory of 4032 4108 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 88 PID 4108 wrote to memory of 4032 4108 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 88 PID 4108 wrote to memory of 4032 4108 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 88 PID 4032 wrote to memory of 5116 4032 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 89 PID 4032 wrote to memory of 5116 4032 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 89 PID 4032 wrote to memory of 5116 4032 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 89 PID 4032 wrote to memory of 5116 4032 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 89 PID 5116 wrote to memory of 3296 5116 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 90 PID 5116 wrote to memory of 3296 5116 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 90 PID 5116 wrote to memory of 3296 5116 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 90 PID 5116 wrote to memory of 3296 5116 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 90 PID 3296 wrote to memory of 4476 3296 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 91 PID 3296 wrote to memory of 4476 3296 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 91 PID 3296 wrote to memory of 4476 3296 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 91 PID 3296 wrote to memory of 4476 3296 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 91 PID 4476 wrote to memory of 2672 4476 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 92 PID 4476 wrote to memory of 2672 4476 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 92 PID 4476 wrote to memory of 2672 4476 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 92 PID 4476 wrote to memory of 2672 4476 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 92 PID 2672 wrote to memory of 2844 2672 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 93 PID 2672 wrote to memory of 2844 2672 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 93 PID 2672 wrote to memory of 2844 2672 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 93 PID 2672 wrote to memory of 2844 2672 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 93 PID 2844 wrote to memory of 1072 2844 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 94 PID 2844 wrote to memory of 1072 2844 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 94 PID 2844 wrote to memory of 1072 2844 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 94 PID 2844 wrote to memory of 1072 2844 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 94 PID 1072 wrote to memory of 1952 1072 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 95 PID 1072 wrote to memory of 1952 1072 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 95 PID 1072 wrote to memory of 1952 1072 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 95 PID 1072 wrote to memory of 1952 1072 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 95 PID 1952 wrote to memory of 3468 1952 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 96 PID 1952 wrote to memory of 3468 1952 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 96 PID 1952 wrote to memory of 3468 1952 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 96 PID 1952 wrote to memory of 3468 1952 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 96 PID 3468 wrote to memory of 4616 3468 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 97 PID 3468 wrote to memory of 4616 3468 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 97 PID 3468 wrote to memory of 4616 3468 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 97 PID 3468 wrote to memory of 4616 3468 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 97 PID 4616 wrote to memory of 216 4616 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 98 PID 4616 wrote to memory of 216 4616 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 98 PID 4616 wrote to memory of 216 4616 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 98 PID 4616 wrote to memory of 216 4616 da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe5⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe8⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe9⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe10⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe11⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe13⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe14⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe15⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe16⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe17⤵
- Suspicious use of SetThreadContext
PID:216 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe18⤵
- Suspicious use of SetThreadContext
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe19⤵
- Suspicious use of SetThreadContext
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe20⤵
- Suspicious use of SetThreadContext
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe21⤵
- Suspicious use of SetThreadContext
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe22⤵
- Suspicious use of SetThreadContext
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe23⤵
- Suspicious use of SetThreadContext
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe24⤵
- Suspicious use of SetThreadContext
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe25⤵
- Suspicious use of SetThreadContext
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe26⤵
- Suspicious use of SetThreadContext
PID:208 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe27⤵
- Suspicious use of SetThreadContext
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe28⤵
- Suspicious use of SetThreadContext
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe29⤵
- Suspicious use of SetThreadContext
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe30⤵
- Suspicious use of SetThreadContext
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe31⤵
- Suspicious use of SetThreadContext
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe32⤵
- Suspicious use of SetThreadContext
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe33⤵
- Suspicious use of SetThreadContext
PID:636 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe34⤵
- Suspicious use of SetThreadContext
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe35⤵
- Suspicious use of SetThreadContext
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe36⤵
- Suspicious use of SetThreadContext
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe37⤵
- Suspicious use of SetThreadContext
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe38⤵
- Suspicious use of SetThreadContext
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe39⤵
- Suspicious use of SetThreadContext
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe40⤵
- Suspicious use of SetThreadContext
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe41⤵
- Suspicious use of SetThreadContext
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe42⤵
- Suspicious use of SetThreadContext
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe43⤵
- Suspicious use of SetThreadContext
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe44⤵
- Suspicious use of SetThreadContext
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe45⤵
- Suspicious use of SetThreadContext
PID:988 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe46⤵
- Suspicious use of SetThreadContext
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe47⤵
- Suspicious use of SetThreadContext
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe48⤵
- Suspicious use of SetThreadContext
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe49⤵
- Suspicious use of SetThreadContext
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe50⤵
- Suspicious use of SetThreadContext
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe51⤵
- Suspicious use of SetThreadContext
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe52⤵
- Suspicious use of SetThreadContext
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe53⤵
- Suspicious use of SetThreadContext
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe54⤵
- Suspicious use of SetThreadContext
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe55⤵
- Suspicious use of SetThreadContext
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe56⤵
- Suspicious use of SetThreadContext
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe57⤵
- Suspicious use of SetThreadContext
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe58⤵
- Suspicious use of SetThreadContext
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe59⤵
- Suspicious use of SetThreadContext
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe60⤵
- Suspicious use of SetThreadContext
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe61⤵
- Suspicious use of SetThreadContext
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe62⤵
- Suspicious use of SetThreadContext
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe63⤵
- Suspicious use of SetThreadContext
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe64⤵
- Suspicious use of SetThreadContext
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe65⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe66⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe67⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe68⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe69⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe70⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe71⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe72⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe73⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe74⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe75⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe76⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe77⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe78⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe79⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe80⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe81⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe82⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe83⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe84⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe85⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe86⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe87⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe88⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe89⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe90⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe91⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe92⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe93⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe94⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe95⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe96⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe97⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe98⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe99⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe100⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe101⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe102⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe103⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe104⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe105⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe106⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe107⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe108⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe109⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe110⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe111⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe112⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe113⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe114⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe115⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe116⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe117⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe118⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe119⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe120⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe121⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\da7b35405eb24215b60549c9d52eccdb_JaffaCakes118.exe122⤵PID:1016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-